Users with both Line Manager and Learning can access My Client Group with lots of access

Summary:

We have found that users that have both Line Manager and Learning roles can now access My Client Group, and have lots of access that the business do not want them to have. When they have Line Manager alone they do not have access to My Client Group.

For example, they now have all the actions under :

New Person, such as Hire an Employee, Add a Contingent Worker etc.
Employment
Compensation
Time
Workforce Structures
Talent
Touchpoints
Absences
Payroll

The goal is that if a person has a combination of a Learning Role with Line Manager, that they should only see the Learning group of actions within My Client Group.