Steps to reproduce:
here is says that https://www.zabbix.com/documentation/7.0/en/manual/config/users_and_usergroups/usergroup

Zabbix server will not send notifications to users defined as action operation recipients if access to the concerned host is explicitly "denied".

case
If Group A has no permissions defined and Group B has a Read-write access to Hostgroup 1, the user will get Read-write access to 'X'.

assign a host to host group HG1

add a user in two groups, one having the host group in permissions (HG1-RW) and second user group with no host group HG1 defined, (which is not explicitly "denied" in my opinion);
and notification action to user group where user has RW permission on problems in HG1 hosts group.

Result:
no notification action executed for user

Expected:
notification action executed for user