Can you provide steps to reproduce this? Also, what version of Redash are you using (you didn’t specify in your question).
Dashboards aren’t tied to the data sources, but queries are. If a dashboard contains at least one widget from a query to which a user has access, the dashboard will appear on their list.
There’s not enough information here to identify a problem, yet. Because what a user can see is the sum of all their group memberships. To properly test this, you need to have a data source that is explicitly excluded from all groups except one. Then test with a user who is not a member of that group to see if the dashboard appears.