Row Level Security - Restriction Groups

Hello, 

We are trying to accomplish the following:

1. Restrict GL Accounts from all users
2. Then, give branches access to specific GL Accounts
3. Finally, restrict access to specific users within the branches

In the attached example, we want to restrict GL Account Access to users in the XXGGM group for the listed accounts.  Our current results are: Accounts 000506442 & 20443000 are still visible. Accounts 190020000 & 200395000 are not.  And when I inactivate the XXGGM group, the results are the same. 

It seems we need to restructure how we are approaching this.  Does anyone have any suggestions for a fix? 

Thank you