Access rules in the User Rights settings are treated very similar to the rules in the Computer Rights setting.
For a rule in the User Rights setting to be considered there must be a registered Connection Suite user logged on (through the IP logon interface) on the computer from which the packet is originating. This implicit rule is independent from all settings, so even an all-blank rule will only match if there is a user logged in to the originating (source) computer.
Furthermore, if a user rule has a value in the User group setting, the logged on user must be a member of that group. A blank User group setting is considered to match any user.
Apart from this, User Rights rules are treated identical to Computer Rights rules. Remember that Computer Rights have priority over User Rights though.