John; Unfortunately, until you go to single entry mode, you are exposed for exactly what is occurring. This is because you are allowing multiple ways to update actuals. One method via timesheets and a second method where the tool calculates what will be placed in the actual work cells of the timescale data. If the second method is used, timesheet users may open timesheets and see pre-filled entries.
One additional item I will note. Single Entry mode only applies to enterprise resources. It’s not as locked down as you might think based on the option documentation.
For example, a task with only local resources assigned can be updated using the %Complete icons in the Task ribbon. But if one enterprise resource is assigned to the same task, the %Complete icons become disabled and the PM would need to update assignment rows directly for the local resources and the enterprise resource would have to submit updates via timesheets.
If you have a test instance, I’d suggest turning on Single Entry mode and experimenting. It took our company several rounds of “playing” to get a feel for what Single Entry does and doesn’t allow.