Question of Document Record Security

Summary:

How to restrict the Employee and Manager access to Document Record differently?

Content (please ensure you mask any confidential information):

We have a business requirement, for the specific document type, would allow employee to View only, and manager can View, Add and Update document for his/her direct reports.

When we test the Restrict Setting on the setup page of document type, Manager can also Add and Update his/her own document record through Me -> Document Record.

Seems like if manager is granted Add/Update access to the specific document type, manager can do it through both ESS and MSS.