Anonymous Thank you very much for taking the time to reply.
The users were assigned to roles that limited the number of metrics they could see and update. The issue was that they were still able to see and update all metrics, not just the ones ticked for their role. The default was definitely not the problem - as stated, the default is to not be able to see or update any metrics.
On advice from Microsoft support, I took the users off their assigned roles, and added them back on again. I also refreshed the scorecards and datasets. It now seems to be working properly for all but one user - I suspect they have some admin privileges that I can't see (they are definitely not admins of the workspace, so it must be something else). They are still able to see and edit all 44 metrics on the scorecard, even though their assigned role says they can see and update only 2.