Here's what I suggest be added at the very end of the FAQ, in its own paragraph (feel free to change stuff around):
If you filter an entry to more than one group, then everyone in each of the groups that the entry is filtered to will be able to see the entry. This means that if one of the groups you filter the entry to contains a specific user and another group that you filter the entry to does not, the user will be able to see your entry. If you wish to filter out specific people from seeing an entry, you should only use one group and keep the users that you don't want to see the entry out of it.