deny is possible

perhaps some people don't realize that any module can propose a DENY for a given nid. just implement hook_node_access_records() and return a 0 0 0 grant with priority = -10 and you will effectively deny access. it doesn't matter that user is a member of a group or has access to a term.