PM only Timesheet approval

We have the global configuration set to only allow project managers to approve timesheets, but we routinely find timesheets approved via the approvals view are made by the direct manager of a resource, not the PM of a project. I recently discovered the project-level option of finer grained control of approvals, but setting this to PM (was None) did not prevent a direct manager selecting timesheets via the resources view and explicitly approving them. The Direct Manager testing this is neither an admin nor a super user. I don't believe we have any validation rules that are in play here either. Other than unsetting the direct manager for all users how do we allow and ensure  approvals by the PM only in line with the global setting?