Read only access to Ancillary Tables

8.5 environment, on prem.

My understanding is that if I want read only access for users to Ancillary Tables I need to use the config utility and set Access Group for Ancillary Tables to a user group that would be different than Maintenance Group or Table Creation Group.      I did this and my users in the group assigned to Access Group are able to edit ancillary tables.

Then I found this documentation that implies that Access Group gives edit rights to ancillary tables.  

Does anyone have a definitive answer on this or know how to setup read only access to ancillary tables?