I think your only options will be to either re-jig your environment to have dedicated iNotes servers and use the server deny groups or write an agent so when a user is added to a group it updates the mail file. The option is set in the $Flags field in the icon document: https://www-304.ibm.com/support/docview.wss?uid=swg21244071&cm_mc_uid=27314236596914930135890&cm_mc_sid_50200000=1493030621