note: brand new vault admin Day 1

we have a vault folder called Vendor Parts, that every user should read-only access to. I created the group, assigned everyone as a member.

For the group:

• Admin permissions: can accept tasks to execute
• Folder permissions: check out file, may see files, read file contents, share file to another folder, show working versions
• State permissions for universal workflow: check out file, read file contents.

For the group settings, Reference dialog: all checked.

• Auto select reference
• always work with latest
• enable get version
• try to check out all ref
• do not mark ref

so user goes to checkout an assy from another vault project, and the parts in the vendor folder don' get checked out, but he can go to the vendor folder and check out manually...what setting am i missing? Essentially i'm trying to setup a read only group.