Create custom access groups and tick exactly which areas they can use. Assigning someone a group (on the Team page) overrides their role — what you tick is everything they'll see. Leave a person on "Role default" to use the built-in role access.