Company Table Security

Trying to determine what the best way to do global table security.  Element rules appear to block access to another company from the screens but Add-in users can query other company data.

Do I have to add company criteria in my table access rules?

Any assistance would be appreciated.