A role assigned to a Group in the Control Panel only grants permissions for Dashboard functions and on pages with Page Privacy set to Public. If a user belongs to more than one Group, they will have permissions based on the highest role assigned.
Assign the role of Viewer to Groups and then assign page-level permissions where needed.