If the custom user has access to customers, they can do all customer activity.  Make the user vendor or view only access.  https://community.intuit.com/articles/1145471-what-different-types-of-users-can-we-have-in-our-company

Resolution for 'access to customers issue: 'Why can a custom access user edit an invoice?' available: Yes.

The access to customers issue or error code is a known issue in Quickbooks Online (QBO) and/or Quickbooks. Support for this issue is available either by self-service or paid support options. Experts are available to resolve your Quickbooks issue to ensure minimal downtime and continue running your business. First try to resolve the access to customers issue yourself by looking for a resolution described in the article. If it is a complex access to customers issue or you are unable to solve the issue, you may contact us by clicking here or by using other access to customers support options.

For more information about resolving issues related to access to customers in Quickbooks/QBO or to get support for the issue 'Why can a custom access user edit an invoice?', click the link below: