My users can definitely only view projects that I have added them to. However, according to my test user account, they are definitely still able to see this button:

And if they click on it, they have some restrictions, but not complete restriction on project creation.

I would strongly prefer my standard users not be able to create any kind of project, and ideally not even see the "create project" button. What do I need to do to make this happen? I've looked at the permission scheme for my test user:


And it doesn't seem to indicate that it has admin access. So what am I doing wrong?