Indeed, you need to refer to the groups using the notation "module.group_id". For example if you wanna set an xml node to be able to see only by the "Employee" group defined on the module base like:

  <record model="res.groups" id="group_user">
      <field name="name">Employee</field>
      <field name="users" eval="[(4, ref('base.user_root'))]"/>
  </record>

, you need to add to your xml node:

groups="base.group_user"

The admin user bypass pretty much all the security checks