Ok, it seemed counter intuitive that I can turn off IP address permissions, yet they can still view them elsewhere. I needed them to be able to manage users, but not view IP information, due to the privacy policy of the site (only employees have access to this). I'll have to tell the admin candidate he can't be one.
Thank you for the prompt reply.