Hi Mark
You might want to raise a customer incident with SAP if that is happening - not taking selection criteria into account.
In the mean time, can you shift the users to a different user group and run risk analysis of that group?
Regards
Colleen