If you've restricted holds by Library Groups, staff can still cancel holds for other libraries outside their library groups.
A number of Library Groups deficiencies can be worked around using other sysprefs or features, but I think this one might need a proper fix...