Not a problem, If I deny access to Users they cannot manage them in CB. However, they can only manage users under their access level so it's all good.

CB inherits from core Joomla users component, but you should be able to change that in CB > User Management > Permissions.

I am trying to figure out if we can make the username and email sync up if they change their email address in their profile? Right now I have their username set to be their email address. If they change their email the username remains the old email address.

Set username to be changeable within CB > Configuration > User Profile. Next set the username field not to display on registration or profile edit in CB > Field Management. It should just use the Username Fallback as configured in CB > Configuration > User Profile, which could be set to Email. This I believe should keep them in sync otherwise you could use CB Auto Actions to push email to username on the after user update and after update user triggers.

The fallback is likely only to apply to registration. To use CB Auto Actions to force them to synchronize you'd just use the below.

Global
Triggers: onAfterUpdateUser, onAfterUserUpdate
Type: Field
User: Automatic
Access: Everybody
Action
Field: Username
Operator: Set
Value:
Is there a reason you need them to synchronize? You can optionally just not use the username for display at all. To do this within CB > Configuration > General set "Name Format" to "Name Only". You can also use the layout parameters within the username or formatname fields to override what they display. On that same configuration page adjust "Login Method" so they can login via email address.