Hello! I have not tried the above scinario, but have you tried following ? This will be available under Content Types > <Block> > Permissions

I haven't seen a similar case either. First, I would double-check that all the access rights are assigned correctly.

But if there is no other option, it could be worth forcing these rules from the code.

One potential solution might be to hook into one of the IContentEvents (like SavingContent or PublishingContent) and do all necessary checks there:

[ModuleDependency(typeof(EPiServer.Web.InitializationModule))]
public class SiteInitialization : IInitializableModule
{
    public void Initialize(InitializationEngine context)
    {
        var events = context.Locate.Advanced.GetService<IContentEvents>();
        events.SavingContent += SavingContent;
        events.PublishingContent += PublishingContent;
    }
    
    public void Uninitialize(InitializationEngine context)
    {
        var events = context.Locate.Advanced.GetService<IContentEvents>();
        events.SavingContent -= SavingContent;
        events.PublishingContent -= PublishingContent;
    }

    private void SavingContent(object sender, ContentEventArgs e)
    {
        var block = e.Content as BlockData;
        if (block != null && IsActionNotAllowed())
        {
            e.CancelAction = true;
            e.CancelReason = "Sorry, you can't do it";
        }
    }
    
    private void PublishingContent(object sender, ContentEventArgs e)
    {
        var block = e.Content as BlockData;
        if (block != null && IsActionNotAllowed())
        {
            e.CancelAction = true;
            e.CancelReason = "Sorry, you can't do it";
        }
    }
}

Another could be implementing custom validation https://docs.developers.optimizely.com/content-management-system/docs/validating-object-instances

Not sure which one is better in this particular case, but these are the first two ideas I would give a try.