How do we disable the employee role for certain employees?

Summary:

We are new to Oracle so still learning how things work. We created a custom role called 'Web Clock Employee - IP Controlled' and it mirrors the employee role except it took out the current time card tile and existing time card time and added the web clock tile. We wanted to restrict the employee's from editing their timecards and we only wanted to give them the ability to clock in/out when signed into the network assigned to certain IP addresses. However, we ran into a problem because the employee role is auto-provisioned so they are automatically getting the