Details:
SQL Server 2014, 10.4.1 geodatabase.
I am the admin of the geodatabase (SDE user created, not dbo) using a SQL Server login.
When I connect via ArcCatalog I see all the feature classes, relationship classes and sde tables.
Most of these objects are registered as versioned.
I added a windows group to the database in SQL Server with nothing but the public role and went through, via ArcCatalog, and granted them permissions to all these objects. When a user in that group connects they're seeing all the _evw views from the versioned datasets along with everything I can see above.
What did I do wrong that they can see all these objects in Catalog?