You can use an account limitation to lock a user into a subset of your devices. That prevents them from accessing any of the other devices. The full-access to device group A and read-only access to device group B concept isn't supported. You would have to create four separate accounts - full-access to group A, full-access to group B, read-only to group A, and read-only to group B.
No. When you use an account limitation you can think of it as a filter - whatever devices you're limiting to are the only ones that user will be able to see with whatever permissions that user has.
For example, if you limit a user to Cisco devices only and they have the node managment permission, they'll be able to manage all those nodes. They won't be able to see any non-Cisco devices.
