As mentionned is comments, you also have to use the /inheritance:r switch to remove inherited permissions.

/grant:r only removes explicit permissions.

icacls c:\temp\test /inheritance:r /grant:r <DOMAIN>\<USER>:(OI)(CI)F /T

To also grant SYSTEM :

icacls c:\temp\test /inheritance:r /grant:r <DOMAIN>\<USER>:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F /T