So when you say get access - you mean see the hub? because even though they see the hub they shouldn't be able to do anything. Unless you have a rule set up to automatically assign a token, or manually assigned a token.
I assume you are using the 'local network' UDC which I think was depreciated in the June release? or the default - as I understand it any local user that tries to access the hub will be added into the user list but this doesn't mean they have access... (I think)
I can't speak for the original poster, but you are correct. For me specifically, I found that detail out later in the afternoon - that the users have access to the hub, but not to access existing apps or create new ones. Originally, there was a user access rule that was automatically allocating tokens to these users, but I disabled it. Then, was running into the issue of seeing the hub without realizing no action could be taken. I'm going to disable that option this evening, we don't want to allow anyone to see anything until it's all set up and allocated.