Webform civicrm integration not respecting permissions
Figured it out thanks to @Colemanw.

The relationship permissions are only for dashboard access and do not act as ACL permissions. 

I installed this extension which transforms relationship permissions into ACL permissions. 
Now it is simple, I simply enable the 'Enforce Permission' option in the'Existing User' field and the drop down only shows the intended contacts.

Yosef