Actually - you have a bit of a problem - access allowed overides access denied (because it's not really denied, just not allowed) - so if they are a member of a usergroup allowed access then they will get access, even if they are also a member of a group that isn't allowed. Moderate posts is the same - the ON setting overides the OFF setting.