I created an external role/profile and wanted to lock down tab groups so that users cannot see a Home tab or "Custom Object A" tab for "Custom Object A" that is only used on Deals as a related list (there is no reason to view that tab).
I logged in as that user and set the tab group to the one I want the user to see, but I don't want the user to see the other tab groups and be able to change them.