Permissions are received from from a server for an account once the user has connected, so there is no permission that can prevent someone from connecting to the server in the first place. A "fresh" client with no servers connected (and thus no permissions) will still be able to add new servers, and if multiple servers are connected they can each have unique set of permissions (i.e permissions from server A won't affect connections to server B).
Can you obtain screenshots from these users to confirm they are looking in the right place? Or correct me if I'm misinterpreting your question.
Oh that's the issue. The webstart client by design can only be connected to the server it was downloaded from (hence not being able to add a new server). I don't believe there is anyway around this, if you need to connect to multiple servers you'll need the full client.