Set the following Business Rule:
1. Click Config, Business Rules
2. Underneath Duplicates, highlight Options
3. Mark the Display only constituents that the user has rights to view when displaying Constituent or Duplicate search results checkbox

If you have 'Display all constituents that meet the criteria' select, this allows restricted users to view the constituent's name to verify they exist in the database without being able to open their record