Mark, are you sure? See this post.
I ran a quick test (v5.1.8 ) and a user belonging to two groups (one group being granted access to universe A, the other group having access denied to universe A) does have access to universe A (in accordance with the link I posted).
Andreas 
(BOB member since 2002-06-20)