Yeah, they can see the summary data, but won't be able to see any of the actual event data itself. This is due to the fact that the summary page data is all pulled from the internal index (fairly certain). You could either restrict the summary page entirely for those users, or create an alternate "censored" one.
You won't be able to limit this on the search app page as far as I have seen. Certainly your users will only see the data you've limited to weblogic but they can see the summary details. I would suggest creating an Advanced XML dasbhoard that provides the search capabilities but that doesn't show summary data.
Something like below and use the same role pre-pended search to limit scope of what the user can search: