• Create hostgroup HG_All_Linux_Servers
• Create hostgroup HG_Critical_Databases
• Create user group A
  • Give read permissions on HG_All_Linux_Servers
  • Give read permissions on HG_Critical_Databases
• Create user group B
  • Give HG_Critical_Databases deny permissions
• Create a Test user 
  • Add user to the groups A and B
• Add a host in group HG_All_Linux_Servers and another one in HG_Critical_Databases

Login with our test user and go to Monitoring -> Hosts and see the servers from both groups HG_All_Linux_Servers and HG_Critical_Databases but only the group HG_All_Linux_Servers will be selectable from the group filter