Users can be restricted to Outbound calling only as detailed in Enabling Your Number for Call and Data Access. However, if you then add that user as part of a team that is part of the call distribution of the number, that agent will now receive incoming calls due to being part of that team.
The outbound call only setup is used to assign a number to an agent without having to set the user in a team or directly to the number. When you restrict a user to outbound calling but then assign a team in the inbound call flow with that same user, the team will take priority and route the call to the agent.
If you see that a user assigned to Call and Data Access is receiving calls, double check and remove them from any team that may be part of the call distribution of that number.