I have a survival surver and in order to protect it while the staff is offline, I have set up a permission system. Each new player that joins is supposed to not be able to build until a new group is assigned. This works as intended in the overworld but as soon as the user enters the nether they can build and break blocks.
My PEX permission.yml file for the group looks like this:
PEX is not compatible with 1.15 and they've recommended users to switch to LuckyPerms until they get a stable version, however you may try removing "- -'*'" tho if that doesn't work I'd recommend you to follow their advice.