Host permissions - conflicting group permissions.

I'm trying to create 2 groups that have different access to 3 hosts, but folks in group B are also in group A. group A permissions then override and do not allow access.

Here's the set up

DC1

Host1

Host2

Host3

Group A has permissions at the DC1 level as power users, but has no access at Host3 level.

Group B has permissions at the DC1 level as power users, including Host3.

Group B (John,Dave) is a subset of Group A(John,Dave,Frank).

But Group B can't see Host3 or the VMs on there.  Presumably because of Group A permissions.

If I delete Group B permissions at the DC1 level, and add them at the Host3 level, same issue.

How do I get it so that Group B permissions override Group A permissions, just for Host3?

PS this is simplified, it's a large vCenter, so adding individual permissions for hosts/groups isn't feasible or manageable.