Partial Security in one cube and full access in other

Summary:

Requirement: in the planning cube (BSO) we want to restrict security to users to only have access to parts of the department dimension and no access to the rest of the department dimension. We have created groups and assigned access to nodes in the hierarchy. But in the reporting cube (ASO), we want everyone to have read access to the entire department hierarchy. (Note that the ASO cube is made read-only through the Time Series dimension, so we can set the department security however necessary for the BSO to work.)

Content (required):

Was hoping cell-level security could work here. But when we try to add all users to read (or write) the total department hierarchy, then restrict in CLS, it overwrites the write access by group at department nodes.