Help needed understanding Access Control in OG

Hello,
I'm here because it seems like the only place I am likely to find some help with Access Control, having scoured the internet for help elsewhere...

I just set up OG on my 5.1 installation and although I have the groups working nicely (well, single group in my case), I can't for the life of me work out how to restrict access to either the individual posts, or the group homepage. In fact, when I enable access control in the OG settings, both my group and the posts within it suddenly become editable by anonymous/unauthenticated users. I have scoured the settings setting everything to be as private as possible, but with no joy. Is it possible that I'm missing some fundamental point?

I have a site full of open content with a few bloggers and content editors. I need one private area restricted to 2 users (as 2 roles). One role has read access only, the other has read/write access. I don't need any per-node per-user access, but I do need that part of the site to not be open to the public.

Apologies if this is the wrong place to ask - do tell me where to go.

Thanks

Dorian