Restrict Access to teams not working

I am testing out implementation of a partner(vendor) backend bridge into our RTC project. I have created a role called "vendor". The only access i gave to this role is the ability to generate queries so save/delete query is the only thing green. We have team areas set up for each product on our team that we test/develop for. I used two team members as guinea pigs and stripped their access roles and added the new role i created called "vendor" only.. I added this team member to two seperate product team areas in which i created two defects for as a test to see if they could 1) see ONLY those defects in which they were team members of 2) could not modify them

I had team members create queries in order to see defect data, they not only can see defect data for tools in which they are not assigned to that team area but they can also modify the defects which is NOT what we want.

Under administrator in categories for every product/team area restrict category item visibillity and restrict work item team access is checked

I also tried access control, members in the team hierarchy and access in the users list and listed the two members.
Any of you have an idea of what could be wrong?