In Solaris, more specific file ACLs override less specific ones, in practice this means a user allow ACE will override a group deny ACE.
In windows file ACLs, a Deny ACE will ALWAYS WIN.
Deny ACEs are pretty unusual - the common practice is to allow access to groups, and make users members of groups who have the access required. There is no "Users Who Cant Vogue" group, you just don't make them a member of the "Users Who Can Vogue" group, then grant permission on "80s Songs" to that group. If that group contains almost everybody, so be it. Being in lots of groups is not a problem in Windows, I think it is a case which is specially optimised. (Some unixes limit you to 32).
In practice DENY ACEs are mostly used in Exchange, to stop Administrators from reading other people's mailboxes.