Okay, scratch all that. Still haven't cracked it. When I log out the course shows up in the list of available courses. So I have to make in unenroleable to students. At which point the users can't see the course in their registrations and so can't access it... argh... looks like I'll have to stick with non-editing teachers.