Sure, this is what we also do. We have a separate role for CAM rights. And you removed the user rights from the NavigationBar nodes as described above, too?
If you removed it there, two things could have an influence:
– Any cache like Client/ClickOnce or even the Server cache. Sometimes it takes a while until new rights come into effect.
– Inherited rights. You should have a look at one example user and check the assigned user group(s) + the groups above it. Maybe some right is inherited from parent to child anywhere.