RCM vs Actual Security

We are working on security settings for RCM and noticed that we can view the Actual results/all workflow steps. Is there a way to hide the Actual workflow steps from RCM only users? Currently if a user has access to RCM under the Model scenario they can still click on the Actual scenario and see their steps/all data. If there is not a way to easily hide the actual workflow steps/data are the 2 main options to create a suffix for the Model scenario and have it be its own cube root or to do slice security? Or do we need to also have the Read group for actuals be a large group of users that don't include only RCM users?