How to enable or prevent certain employees from entering project transactions with TC

When creating Transaction Controls we have a Person field when creating a rule, if the transaction controls are exclusive would this person be excluded from being able to charge transactions against a project? For example, if they were to create a new invoice with this particular project.

So far I have been unable to create this behaviour, are there any conditions that need to be met to prevent certain employees from charging against a project?

Or if the transaction controls are inclusive and a person is selected, we would only want this person to be able to create Purchase orders, Invoices against this project. How could this be achieved? Am I missing something?