Can a whole office see the site?

Yes. Access → IP addresses that can see the site takes one address or range per line, such as 203.0.113.0/24. Everyone arriving from there sees the site on every device without a link or a password, which also suits an uptime monitor or a payment provider's checker. Your own address is shown under the box. If your site sits behind a proxy other than Cloudflare or one on your own server, check that address is the one you expect before relying on it.

On a server that writes IPv4 addresses the IPv6 way (::ffff:203.0.113.7), behind Cloudflare or a proxy of its own, the address under the box used to be the proxy's, such as 127.0.0.1, and a line copied from it let in every visitor who came through that proxy. Each visitor is now read by their own address, so that line no longer lets them in. If the address under the box has changed, put the new one in place of the old line.