Everything would be cleared after you read:https://us.battle.net/support/en/article/loot-settings
That tells you the whys and hows of the Dungeon Finder Loot settings.
If people are able to roll on gear despite those settings, it is a bug.
Go to the Bug Forums and report it.
Say something like:
While in a Dungeon Finder group, in the SERVERNAME, at SERVERTIME.
In H. Scholomance Dungeon, the Headmaster's Will item dropped.
The Protection Paladin was able to roll Need on it.
There, it tells Blizzard that in this place, at this time, under these settings that Blizzard told us to use, something, that the loot settings should not allow, happened.
enough of these will fix the bug to match the loot settings.