allow certain AD group policy members to blocked site

wondering if anyone can help,

by default we block webmail,  but we have a AD policy/group for webmail

so we would like anyone in the webmail group to be allowed and everyone else blocked

i ahve enabled "Use most restrictive group policy"