Hi,

In Odoo 11, Leaves app you two groups Officer and Manger and the normal employee shouldn't  have access to Leaves and you will just give Employee access to Employees so he will be able to create leaves only and Leaves officer can approve/refuse it and the Leaves Manage can validate it.

Example: I have create new user and linked it to employee and this user have access to Employee as Employee and other access but not have access to Leaves.

User access screenshot

Then I logged in with this new created user and I created a leave and you can see there is no approve/refuse button:

Employee leave screenshot