I follow your logic here, but the plugin gives enabling exceptions priority over restrictive ones without regard to whether they are assigned to group or user.
In Press Permit Core 2.2.4, I’ve added support for a constant definition which will cause restrictions (“Not these” exceptions) to take priority. To get this behavior, add the following to wp-config.php:
define( 'PP_RESTRICTION_PRIORITY', true );