I just added another email I have as a guest account to see what their experience is like. I am surprised to see that this new guest user has full access. Add devices, change apps, delete app code. Seems more like I just added a new admin.
I want to add a user so he/she can have a presence sensor with their phone and receive notifications. But, I don't want that user to be able to access settings that affect everyone.
You are not doing anything wrong. A guest account has very little restrictions. It is mainly utilized by those who don't want to share admin credentials when the Mobile App is installed on additional phones, and to restrict access to the subscriptions store. But from hub's access perspective, there are no restrictions.