The one article on RTC(4) for RTC resource access control is called:
"Controlling access to source control in Rational Team Control"
The section "Use permissions to control access to streams" (RTC3.0.1+) repeats what you did (stream visibility and ownership), but also adds:
Create a private component in the stream:
- In the stream editor, click the New button beside the component list. In the editor give the name the component Flux Capacitor 2.
- Save the editor.
- Make the component private by selecting Flux Capacitor 2 and clicking on the Change Owner button.
- In the ownership dialog, expand JUnit Project and select Flux Capacitor Tiger Team. Visibility is limited by checking the Restrict to members of this team area and its child team areas
So make sure your components are private as well in your setup, and see if that resists better to an RTC4 upgrade (since you can have a working RTC3 client with an RTC4 server)