Set role + branch access. Per-module overrides live on the edit screen.
Branch access
Pick which branches this user can work in. Owner / Admin sees all branches regardless.