
If the user is allocated as a resource (or manager) for the task (Or issue/risk) then they will be able to update their progress on the task. I believe that the viewer only setting is secondary to allocating a user work, so being a resource on a task overrides other settings.