Is this the same ECC as you're getting the HCM data from?
Make sure ECC is a Business Suite system - you should get a FUNCTION_SET privilege HR_COMMUNICATION (or similar). Also make sure NO_USER_ACCOUNT is set to 1.
Assign that to each user coming from HCM as part of the import process.
The Assign Master Privilege task is
MASKEYVALUE %MSKEYVALUE%
changetype modify
MXREF_MX_PRIVIELEGE {A}<PRIV:%$rep$NAME%:ONLY>
Assign this as the 'No master privilege task' on the repository and it'll do the work as soon as the functionset is assigned. Note that this task also works for every other repository.