1) Go to Settings -> Site Security then click Add.
...
E.g. Setting admin with settings and admin without settings to the group Domain admins means that Domain admins group will have access to the full access portal site.
You need at least one scope set to "Admin without settings" so the restriction can be achieved.
6) To restrict access to information to a user that is a member of a team, configure "Users can only see Teams they have permissions on" to "Yes" in the top menu:
