Go into the properties of the drive, folder, or file you want to set and then click add user... then you can assign all the security options for the user you add. You can setup everything from read, write, modify, execute.. whatever you want. Deny ALWAYS overrides allowed access. So if you deny a whole group access to something, and then assign a single person in the group access it wont give it to them because the deny from the group access will overwrite the allowed access.