@Jan If this user is able to view dashboards created in global tenant, then I am not able to reproduce the issue. I have set up roles exactly the same as your files, except I went further and put ‘*’ under index patterns for both roles, and still the tenant limitation is there.
Can you try to upload the configuration using securityadmin.sh script? Just in case API caused some issues.