Xero does have a number of options.
You can have a user with invoice-only access which will allow them to post invoices and bills and enter payments against them. They then wouldn't have access to bank reconciliation functions or reporting.
You can have a standard user with limited access to reporting so this user could complete the bank recs, edit settings and invoices/bills but not access reports.
Loft maintains advisor level settings for the API access but I don't think anyone really needs that unless its your actual accountant.
Important to note that you have to specifically give users access to payroll.
Here is a screen shot of your options when you set up or edit a user.
There is a wealth of knowledge in Xero if you follow this path to get the help page:
SETTINGS / GENERAL / USERS
Then Click on Understand User Roles
It will take you to these further help articles https://help.xero.com/us/Settings_UsersRoles