Access Control - Class of Service

Sorry if this has been asked before, I have tried to search the forum.

What order are the acces control class of services implemented (top down or randomly)
As an example, I am trying to stop everyone except for 20 users from sending to xxxxx.xxx.
I have entered in the default class of service an entry in smtp outbound that restricts users from sending to xxxxx.xxx
I have then created a new class of service allowing the 20 users to send to all domains.

This does not work:-(

We have approx 5000 users in 15 different domains.

Any ideas?