If the permissions setup is correct then it does work.
One common thing that is misunderstood is the Inheritance. If the user who is able to download belongs to a UG whos Parenent, Grand Parent or similar of Registered then by inheritance they are also members of the Registered UG.
To fully understand I would need to know the setup of your jD categories, the User group sructure and what permission for which UG. I f you like I will look at your site but for that I would need super user details sent to me by PM - clck on whitish square with a little tail near my name in this response