Usergroup permissions are as I state. They are absolute. If you give a usergroup permission to upload they can upload. Now you can refine permissions under admin edit categories for each category the usergroup upload perms.
If someone can upload then they have to be in a usergroup you allow to upload.