We don’t use territories, so all my knowledge is second hand. But from what I’ve heard, this security is built-in to Epicor, and not anything you can control.
It has to do with authorized users assigned to workforce, and territories.
Check out this topic:
Particularly the 2nd and 3rd posts