It looks like the setup of roles was correct, however the way permission was given was incorrect. I will detail the correct way here as I don't think it's very clear from google searches currently.
First of all,
sitecore\Sitecore Client Users is the minimum necessary for a new user to be able to login, the new custom role should implement this or any role that inherits from it (such as
Now to stop all base permissions: go to the custom role and allow read for the top level "sitecore" item AND deny read for descendants. This can't be achieved on the GUI table, you must instead click the button
Assign on the top bar.
Now from here you can build up. As a rule of thumb, you should mostly allow read/write for the item only (such as the webpage) via the
Assign button and not allow read/write for descendants (no need to deny, just leave the tick/cross empty for the descendants). Since you have read denial set on the top level sitecore item, it will flow down to all children. The reason for allowing read for the webpage only and not descendants: so that child webpages don't automatically get the read permission. Then you can do a full read permission on the
Page Content item of that webpage.
This has solved most of my requirements/issues. Then I got a mysterious issue with 2 very similar roles that should behave the same but they don't. The folders
Templates were showing in one and not the other. I installed the Security Rights Reporting module to see if there was a difference causing this (https://github.com/jbluemink/Sitecore-Security-Rights-Reporting), running it on both users and both custom roles. Nothing came up. Then I came across this page (https://doc.sitecore.net/sitecore_experience_platform/content_authoring/the_editing_tools/the_content_editor/customize_the_content_editor), the difference was that while logged in to the user, you can hide
hidden items in the content editor (log in to user > Content Editor > top left Red menu button > Application options > Untick
Hope this helps someone!