Send me please a screenshot of role assigned to a user with restricted access.
Check if you really restricted access for this user to iThemes Settings page. If a related menu item is blocked by User Role Editor Pro, but you can access it via direct URL, give a try to a development version of URE Pro 4.25.b4. It includes some enhancement to the URL blocking logic.