Payment methods can be defined at account and at group level. If during checkout users can see payment methods that are not enabled for their group, it is very likely that their role has the permission See payment methods enabled. This would override the group settings and make all the payment methods enabled at account level visible. More on roles and permissions here.
Also, please ensure that the user is not part of multiple groups, as the visibility on payment methods is additive - i.e. a user can use all payment methods enabled for all the groups he belongs to.