Make sure the permissions of folder 'Dash1' and its sub folders have access to only 'RoelAppl1'. If you have separate folders for the reports, make sure permissions are set accordingly.
Hope you have removed access to authenticated users for these pages.
I'm sure that the permissions are set accordingly for both dashboard.Authenticated users and Biconsumer users have not access for both dashboard.
The User1 in the menu don't see other dashboard that Dash1 but for some strange reason if he pastes the url of Dash2 he can see it!!
I'm using Obiee 11.1.5
Another option is to set the access for 'RoleAppl1' as 'No Access' on Dash2.
Impersonate as that user and verify the folders that the user has access to, from the below URL. If you see anything related to 'Dash2' that's where the issue is.