Need to restrict Site user to not be able to search or access orders from other sites or plants

I have a site that is managed by an external warehouse, we want them to fill the orders and ship the product but we don’t want them to see other sites orders, customers, shipments etc.
I created a user with access to this site only and tested , the only problem is that Epicor security doesn’t limit the access to Orders, Customers and other confidential information (confidential information access was resolved by restricting access to certain modules for the user) I can not find a proper way to restrict access to information that doesn’t belong to that site.

Hope someone can help, thanks!