The recent Console migration means that users can no longer be added to the Sandbox environment only. This also applies to the Live environment, meaning that any user added to either the Live or Sandbox environment will be added to both environments.
This change is by design however, we are continuing to review and gather data on how our clients are using the Console and changes may be made in the future.
For the time being, if you require Sandbox and Live users to be kept separate, you would need to create 2 separate apps - one that you would only use the Sandbox environment and the other would use only the Live environment. This would allow you to keep Sandbox and Live users completely separate.
Read More about the Console migration here.