High-volume customer portal users are unable to participate in the salesforce sharing model. This means:
- The setting in Setup | Security Controls | Sharing have no impact on
- The role hierarchy has no impact.
- Apex managed sharing rules, and manual sharing have no impact.
What you get instead is the ability to restrict them to seeing record where either their account or contact is in any lookup field on the record. You can set this per-profile and per-profile under Setup | Customer Portal | Settings. For example with cases:
As Ralph poined out, apex running in system mode (e.g. without sharing) is exempt from the above as it bypasses the sharing model and the HVCP sharing sets completely.
There's also a great graphical summary of the features available to the various types of portal users over at the limitexception blog. The licenses in red circles are what this answer describes.