REMOVE that user from the db_datareader role -that role allows reading ALL
tables.

Create a new Role, add the user to the new Role.
Then for each table that the user needs to read, give SELECT permission to
the new Role. (By doing it for the Role, if you need to allow another user
(vacations, etc.) to do the same thing, you just add the additional user to
the same Role.)

Verify that the user is not a member of any other Role that has permissions
to SELECT data from the tables.

Make sure that the 'Public' does not have SELECT permissions for any
tables -PUBLIC 'should' not have any permission for any activity for any
object.