Currently, form access is only used to constrain the visibility of the navigation items that show up in the user's menu bar. So if some users can press the new button, and some can't, you need to have two separate forms: one with a new button and one without a new button.
That sounds like a bug. Have you disable the 'objectNew' form in form access, or have you disable the object in the 'objectNew' form in object access? In the last case it's right that the 'objectNew' forms open, but you will get an error after opening the form, frrom the XAS because the user haven't rights to create an instance. But in the first case (you have disable the 'objectNew' form in form access) it's a bug that the form still opens.
But you can work around (and I think that is even a better solution for your case) to make two overview forms. One with the new button, and one without the new button. With form access you will assign the form without the new button to the concerning userroles.