I'm unable to get this working in my companies Sandbox so I've spun up a brand new Developer Edition Org to see if I can replicate the issue. Being a brand new org there are no permission sets, territory management, etc.
I'm using the Standard Profile for my Test User
I've set the OWD Default for ACCOUNT to be PRIVATE When I logged in as Test User I was able to confirm they could NOT see the Account records I created a sharing rule whereby all Account Records owned by the Role and Subordinates was shared to a Public Group called "read only" I made the Test User a member of the Public Group called "read only" I checked the Sharing Hierarchy of the Account record and confirmed that the public group called "read only" had read only access and nothing more I logged in as the Test User and discovered they have EDIT Rights to the Account Record.
The USE CASE I'm trying to solve is this.
- Make a standard object like Account have default access of Private via OWD Sharing Settings
- Share out access to a limited number of users via Public Groups to have READ ONLY access to a standard object like Account
- When administering Users in the future add them to the relevant Public Groups when creating their User Account thus automatically giving them the current level of PRIVATE, READ or READ/WRITE Access.
Implicit Sharing doesn't come into this because the Account Record is the parent object.
Just to emphasise this is a brand new Org and all I did was as listed above. There is no legacy configuration to get in the way. I'd be curious to see if others can repliate this behaviour in their Orgs too.