Only one replica should be designated for the auto failover, this is done by setting a non-zero "Failover Timeout" in /admin | System Status/Settings | Cluster Management .
The remaining replicas' "Failover TImeout "should be set to 0 to prevent them automatically failing over.
When selecting the help bubble beside the 'Failover Timeout' on the Cluster Management screen, this detail is shown:
The number of seconds this replica will wait after loosing contact with the authoritative primary before failing over. Enter a value of 0 (zero) to indicate that this replica will not automatically failover or a number value between 60 and 3600 (3600 seconds = 1 hour)