Ok, I missed sub step 10 under main step 2 which says, "Under Step 4 of 10, they should only need access to the CRM and the QuickBooks tab groups, with the default being CRM."
This should be put in BOLD as it's a big change. It wasn't made clear enough that the old roles are going away and there is only going to be one role. I know it says it, but it's not emphasized enough when such a big paradigm shift is needed.