The behavior you’re seeing is expected — the Menus tab on Groups doesn’t restrict apps, it just adds extra menu entries. By default, users will still see other apps if they belong to groups that grant them.

In Odoo, each app icon is just a top-level menu, and visibility is controlled by the groups assigned on the menu. A user will see a menu if they’re in any group that gives access to it.

 Best way to do what you want:

• Use the standard security groups that come with each app (e.g. Manufacturing User, Inventory User, HR Officer/Manager). If a user isn’t in that group, they won’t see the app.
• For your HR group, remove users from Manufacturing/Inventory/etc. and only give them HR-related groups.
• If you need more control, you can go to Settings > Technical > User Interface > Menu Items, open the top-level menus (like Manufacturing, Shop Floor), and set the “Groups” field so only the intended group can see them.

Also note:

• Admin users see more apps because they’re in many groups.
• Superuser (developer root) bypasses all restrictions.

So the key is managing group membership and menu “Groups” settings, not the “Menus” tab in Groups.