For a group name to be authenticated locally it needs to be in the local names.nsf, not on the server.
Also, when testing security locally you should make sure you have the ACL “enforce a consistent ACL” setting checked. Be careful with this that you have explicit manager access first, as once you have that on, you can’t get back in without a valid entry in the ACL, there is no local security workaround.