When I uncheck Operations in Customize Operations windows, there is no effect on web interface. All enabled custom commands are displayer on the web interface.
Please make sure that you've selected the correct Web Interface in the Interface type drop-down list of the Web Interface Customization tool.
More over, it seems that my test user was able to launch every customs commands regardless security roles
Did you check this in AD object lists? The thing is that in AD object lists, if a user has sufficient permissions to execute a Custom Command at least on any objects in your Active Directory, the Command will always be displayed for objects of that type. So, for example, if a user has the permission to execute the Deprovision Custom Command at least on one user in your AD, it will always be displayed in grids when users are selected.
However, Custom Commands are executed on the selected objects one by one, and for each object Adaxes will check whether the user has sufficient permissions to execute the Custom Command on it. For those objects that the user doesn't have sufficient permissions, th Access is denied error will be shown.