Groups Deny Rule

Hi there, I hope you can help me here!

Here are my groups:
Cluster One
Hub One
Cohort One
School One Cohort One
User One
School Two Cohort One
User Two
Cohort Two
School One Cohort Two
User Three
School One Cohort Two
User Four

I have a Hub One Forum that I need to allow all users in Hub One access to but, as they finish the programme, their cohort will be removed so I need to deny access to users in Cohort One.
How would I do this?