The only way to do this, currently, it to actually remove them from the game permanently by goin to the campaign page, hovering over their player account avatar, and selecting “kick” or whatever it says. Otherwise, players are free to come in and read characters and handouts to which they have access, among other important between-session activities. This isn’t a bug. It’s intended to be that way, currently.
