Make sure you leave the template role permissions as all grey when starting out (defaults to false).
You only want to give them setting permissions inside the instance, not ad the ADS (main panel) level, because ADS permissions are not included in the Template Role.
You want to manage the instance, then add the game server setting permissions to the template role, don’t include any setting permissions you don’t want them to have.
This guide here is a good read for how permissions are laid out:
https://discourse.cubecoders.com/t/managing-user-permissions-in-amp/2301