User access needs to be limited

I have set up the main BU of the company and under that have 3 child business units, lets say US, UK and China.

With these BUs I have the teams auto created and users in each BU but I am trying to restrict users in the US being able to see UK and China Leads and Opportunities, UK to not see China and US and China to obviously see their own and no one elses (basically 3 independent pools with only the members of the Parent BU to see all leads)

I have users created with standard security profiles with the access on the security role being the Yellow Semi circle (BU) for leads and opportunities across the board but when i log in as a test user I can see all leads and opps.

can anyone point me in the right direction?

thanks in advance