How do I get Cell Level Security to allow an Entity to see other Entity's booking on its ICP?

Summary:

Works for 1, but assigning a user to 2 security groups denies everything in the cross section. :)

Content (required):

ENT_A should have read access to All Entities for only for the ICP_A. For the ENT_A security group, I first grant "normal" access to all entities, then I deny read access to all entities in combination with all ICP's (exception ICP_A). Appears to work fine.

I do the same for ENT_B and that works fine as long as the user does not also belong to ENT_A security group.

Is there a way to get the not