Facebook privacy setting?

[AuntieZoey]

All posts, pictures, videos, and so on of my Facebook page can be seen only by MY FRIENDS.
(Well, except a profile picture on a top page)

But someone said that;

if my friend (Mary) comments on my wall, Mary's friend (John), who is NOT my friend, can see MARY's comment along with MY post.

I thought if I set my privacy setting "Friends" (not "Friends' friends")", my friends' friends, such as John, can never read my posts.

So which is true??