I've solved this one, so am documenting it.
Firstly my description is wrong above. The "Manager" role does work. I has cloned this role and was using the new cloned role when trying it. The issue was that when cloning or duplicating a role, its overrides are not cloned at the same time.
Within the new role you need to Allow role overrides on appropriate levels
- Site administration
- / ▶ Users
- / ▶ Permissions
- / ▶Define roles
and click on the tab Allow role overrides. I clicked on everything from Teacher down to Authenticated user on front page and this worked. I then removed unnecessary control privileges for this new role.