This user has been denied support.
Actually, permissions should be considered properly in the Sitemap already.
However if you browse the sitemap yourself while you're logged in as user with the permissions, you will see the links in the sitemap too. It's dynamically generated based on the permissions of the current user. Try browsing your own sitemap as guest (if the search engine has the same permissions as a guest on your site, which is the default setting).
If you see something as a guest that guests are not able to see, please give a detailed report (which item was linked, and what permissions are set where to prevent guests from seeing that item). Thank you.
And to answer your question in regards to bots: If you have links in a sitemap that google isn't actually allowed to access, it will display a warning for your sitemap in Google Webdev Tools - but it will still index all links of your sitemap that it can access. Nevertheless there shouldnt be any inaccessible links in the sitemap that Google sees.