Thanks @Fubar
I think I've got it now.
The 'Signed in as...' at the top of the screen determines whether I have visibility of the site:

If I log in as a different user which hasn't been given visibility of the site, I would see:

I use the 'Sign-in' link to log on as a portal user, which could be AD, AD B2C or some other authentication method:

If I log on as new user, whether AD, AD B2C or some other authentication method, a new Contact record is created. In the example below, the top two are AD B2C users and the bottom two are AD users.

Since I want my AD users to have the same, known configuration at the outset, I think the blank Contact record can be and should be deleted. I can't see what purpose it serves other than to confuse unnecessarily. If I delete the blank Contact record and then sign up as a new user on the portal, it will create a new Contact record and it will be consistent with any other Contact record for new users.