The GRANT statement makes a user a member of a group.
Membership in a group can be granted either by the DBA or PERMS ADMIN authority.
When users are assigned membership in a group, they inherit all the permissions on tables, views, and procedures associated with that group. If you do not want a specific user to access a particular table, view, or procedure, then do not make that user a member of a group that has permissions on that object.
You cannot revoke permissions for a specific user within a group.