I could be doing this all wrong, but I will mention it in case there is an easy fix.
It seems the ACL under course "Lesson View Confirmation" may not be working properly.
As we checked certain ACL groups that should only be able to view the course.
Assuming a user wasn't in the group they shouldn't have access to the course and/or course/lessons should not be visible to this user, correct?
Now, if a user wasn't in a particular ACL group and it wasn't visible, if the user had the link, they can easily enter the course page and lessons.
Is there another step that I am missing in order to restrict certain members within ACL on viewing the lessons, if they are not assigned under "Lesson View Confirmation"?