You are close. Their will be an option of allow or deny for each forum. No need for both. If you have a forum where you want only a few people to access it, then you would choose the allow option, and choose which groups have access to it. If someone becomes a trouble maker, then you take them out of that group. If you have a forum where you want everyone to have access to it, except for a few people, then you would choose the deny option, and choose which groups you don't want to have access to it.

---
Scream
http://www.wcsoft.net