I'll have to re-read the requirements doc ... Ars Digita never implemented this though it is something I've thought about. I've not done so because the extra layer would, I think, kill scalability of the permissions system.
Anyway ... no, there's no way to tell it that user U should not have the same privileges as other members of group G. The only way to do what you describe is to assign privileges to individual users in the group rather than the group at large. Or to create relational segments (group subsets) to further partition the group and assign permissions on that basis.
