With '*' in COMPANY_CODE and DIVISION_CODE user will be able to see all listed codes for other users. As you are having only ADMIN user currently, you can leave it blank instead of writing '*'.
For example do check bottom example on this page - https://help.qlik.com/en-US/sense/September2017/Subsystems/Hub/Content/Scripting/Security/manage-security-with-section-access.htm
As Rahul suggest this is because of the use of '*', as you would expect this is wild card charater.
But it will only give you access to any of the COMPANY_CODE or DIVISION_CODE that are used in your section access. One way to get around this to create a dummy user that have all the COMPANY_CODE's and DIVISION_CODE's listed in the access table
Concatenate Section Access;
'Dummy' as "USERID",
'User' as "ACCESS",
Resident 'Your table'
you table being where the COMPANY_CODE and DIVISION_CODE are kept in your data. You may have to add more to the script if they are kept on different tables.