Each User right on the VIP Online can be configured at the Contact level. 

You first need to click on the Contact name, then in the menu that opens up in the right, you can click on the VIP Online tab. 

You then have three points on which you can act to refine the User's rights.

You can choose which role you want to assign to a Contact. This role determines if a Contact can download tickets for this Account, and if configured, for which sales specifically. If you set the role to None, this person cannot log on to the VIP Online Portal at all.

When this checkbox is checked, this Contact is an online administrator for this Account. This means that this User can add new Contacts and Addresses, if configured, and that (s)he can view the entire order history including invoices. Online admin automatically allows this User to purchase items online for this Account as well.

When this checkbox is checked, this Contact can purchase items online for this Account.