Perspectives Access - Capability Assignments

[spiderwallet]

Hi All,

We have multiple users that have Perspectives Access to 1 or more tm1 instances.
We want to 'DENY' access to some based on AD groups via Capability Assignments (Access to Server Explorer).

i.e.
'DENY' Forecast AD group in the Budget Instance
'DENY' Budget AD group in the Forecast Instance

This works fine except for when a user has access to both as 'DENY' takes precedence over 'GRANT'.

How do you go about this? Do you create specific AD groups to restrict perspectives access for each scenario?

Cheers
S