View only access to a specific business unit and transactional access to other business units

Summary: How can I grant access to a user to query invoices across multiple business units but enter transactions only in one business unit? I have created an inquiry only role and a role to create invoices and assign specific BU's to each role. However, when the users goes to enter an invoice they are able to select all the business units assigned from the inquiry role.

I have tested each role individually and they work as expected, the issue occurs when they are both assigned to the same user.

Content (please ensure you mask any confidential information):

Version (include the version you are using, if applicable):