Record Rules are normally in pairs.

For example, the access group “Sales / User: Own Documents Only” has a Record Rule on Sales Orders (and Quotations) with this domain:

['|',
   ('user_id','=',user.id),
   ('user_id','=',False)
] 

This will only allow access to:

• the user’s own orders / quotations (where salesman = current user)
• orders with no salesman (user_id) specified).

Alongside this, the group “Sales / User: All Documents” has a Record Rule with this domain:

 [(1,'=',1)] 

This will grant access to ALL Sales Orders / Quotations.  So there is no restriction.

You should be able to adapt this for your needs.  If limited access is available to all users you can use the group base.group_user  (Internal User) for the first rule.

 More information about Record Rules