[nambisolo]

I believe I've got to the bottom of this and access is now working as required. I hadn't configured each user's access mask correctly.

The solution was to set the user's access mask to allow access to the parent forum (I think Lynne may have alluded to this). Access was then denied, where appropriate, to other forums.

With regard to applying additional usergroups, this would only work if forum permissions could be set by using a combination of primary and additional usergroup values (like search). I think that would be slightly more intuitive than access masks for the job.

Thanks Lynne and Kevin for your time and advice.