Configuring My Site in SharePoint 2016 on prem, help!

Hi again,

I was all this morning trying to manage permissions in the My site but I can't make it works :-(

I took some screenshots to illustrate better what I am trying to do: 

I took a sample user, Hernan Perez, which I created in AD. I have not done anything else to this user, I haven't managed permission in any way. Just created it in AD. 

The first printscreen shows how Hernan sees its "About Me" site: 

The red marks shows what I want disabled/hide so he doesn't use it. 

This second printscreen show his "One Drive" site:

Here, as you can see, the user Hernan has given Admin permissions, that's why he can see the site settings link. I don't want that this user has access to the site settings page. 

I took a look to the site settings page logged in with the same account and the to the permission's settings and surprise, Hernan was given Full access to the One drive site: 

What I don't understand is that I, as the web application admin, I've never managed the permissions for this user, how can he get Full access? 

The web application that host the personal sites has the Self site creation activated as the settings are the standard one. 

I was testing what you said about create a new permission policy in this web application but I didn't find any settings that acomodates to my needs (allow the user upload, read, edit documents in one drive site but without Full access permissions).

This is a Sharepoint 2016 on prem environment by the way. 

Best regards

Americo