Under normal circumstances, assuming that the server is configured correctly and that there are no security vulnerabilities in either your server or your PHP code, there should be no way for any normal visitors to see your PHP source.
The reason you cannot hide HTML/CSS/JS from users is because HTML/CSS/JS are all client-side code, meaning they are interpreted and executed by the user's browser. Obviously, you must send the code to the user before the user's browser can execute it, so users can easily make their browsers show them this code.
PHP, on the other hand, is server-side code. This means that your server runs it, and only sends back the results to the user. ("Results", for the most part, means anything you put in
echo() statements). Thus, there should be no way for users to look at the original source. They are limited to stuff that you explicitly 'echo' (plus maybe PHP error messages, if you have them enabled).
If someone guesses the URL of a php script and tries to access the URL directly, the server will still just go through and run the script, and send only the output back to the user. The server runs the script each time it is requested. What the user will see depends on the specific script and your server configuration. If the script requires user input and none is provided, then it is likely the user will just see an error message.
read/write rights are required for the user to actually make the php
work, or is it fine to take user's r/w access to the php files and the
website will behave the same accessing the php when user sorts of
request it using the website?
I have no idea what you mean by this, could you elaborate?