Upgrade before doing anything?

even if I take away all the permissions in my defined membership level, the user can still post pictures (not gallery pictures), see and edit profile fields and basically do more than what I want without buying an upgrade. Is there something easy I'm just missing. I've looked for over an hour now and can't figure out how to do it. Even if I turn off auto approve in moderation settings it won't help because I want the member to pay right after they log in for the first time. Yeah, that's it. I want a member to have to upgrade first before they can do anything. Possible?