The typical workflow filter is setup to define each group you wish to grant permissions to execute that workflow command. In general it is best practice to define the groups you wish to allow this permission to, since allowing all but one group can result in new groups getting created that could have access you never intended. Below is a standard workflow filter:
In this example we have set the workflow filter to allow the group CPTAdmin or the group Editors to execute workflow commands that use this filter.
You can elect to grant access to all groups but a single one by doing the following workflow filter:
In this example there is a single entry of Group "Cannot Publish" with comparison of greater than 1. In this scenario the value will never be greater than. Note this will only work for a single group you cannot add two groups. This is because workflow filters support compound rules where you require two groups to click to execute and adding a second would make that scenario possible though highly unlikely.
