services.openssh.settings.DenyGroups

If specified, login is denied for all users part of the listed groups. Takes precedence over . See sshd_config(5) for details.