The end users are assigned roles on the front-end (Gateway) as well as back-end (ERP) side according to the application which they want to use.
As I can see in the screenshot, you seem to be using Apps based on HANA Live Content which use XSOData Services; hence additionally you will have to assign roles on the HANA side as well.
You can check the corresponding roles for each app in the Fiori Apps Library.
Regards,
Karan