Deny Access in file smb

I have the following situation:
I need to be able to deny access to a shared folder with smb to an AD security group, ie:
I have the following scenario:
A user has normal access to several folders, and for some security issue is necessary to remove the access permissions to the folder, but we need to be able to do it from a security group of AD, then what I set is to add the group that denies to the shared folder, without permissions(Deny All), then in AD I pass that user to the group that denies access, but when I connect with the user login to perform the tests, somehow I still access that folder. Does anyone know if the denial has more weight in Isilon? Is the query understood?

Thank you very much
Regards