Non-admin access to the settings modules

Non-admin users should not have access to the Sage SM settings modules, even read-only. I have a user set up with very basic access for daily logs, yet they can see the list of all the Sage CM users, their email addresses, and so on. Non-admin, logged-in users should have access only to their profile settings.