The security rules are positive rules. The one giving access wins.
As a better example we sometimes allow sheets only for certain people.
We have to:
1. disable the rule to give sheet access to everyone
2. enable the rule to only give sheet access if they are allowed to.
If you only apply rule 2 everyone will still have access...