how to restrict universal content management (ucm) or content server access?

Summary:

We are looking to restrict access to UCM/WebCenter Content area, but I cannot find a way to do so in the security console.

I found that in the Content Server you can view the roles a person has, but some of them listed are confusing and don't say they are assigned to anyone in the Security Console i.e, authenticated, PersonalSpacesAuthenRole, UCM_SpacesAuthenUser.

Another question I have is it seems like have any role code with %RWD gives you access to import/loading files to interface, and also gives you Content Server access. Is there a way to give only the scheduler job access, but not the Content Server? Any help would be greatly appreciated!