If you explicitly deny the permissions for all the repos at the server level, you need to use:
4. Override both, check allowed and uncheck denied (example view)
NOTE: If the permissions are denied, it will always prevail. If the permissions are not explicitly allowed, the operation won't be allowed.
What you can also do is:
- Neither allow nor deny the permissions at the server level and then allow the permissions at the repo level (only for the desired repos). This way, you won't need to overwrite permissions and the result will be the same.