How give term-based Taxonomy Access Control VIEW DENY over type-based Content Access VIEW ALLOW

Issue Summary

Example:

I have a custom type Document (for handling extensive metadata on an attachments). By default, anonymous users should have access (most fields of) the Document node, as declared by View any content for 'anonymous user under the Access Control tab for the custom type Document, which is equivalent to an explicit VIEW ALLOW.

I have a Vocabulary Copyright with tags (Drupal "terms") for various degrees of access for different roles. When a node is tagged by 'restricted' it should not be visible to 'anonymous' users, expressed by a VIEW DENY for role anonymous on that term.

However, when I enable Content Access for node type Document it overrides (ALLOWS) the Taxonomy Access Control setting; I need to prioritise TAC over Content Access.

I have installed Module Grants after inspecting its docs carefully, however it does not seem to offer the ability to prioritise a DENY from one module over an ALLOW from another, it only offers options for interpreting no statement on grant access:

Configure behaviour when multiple content access modules are enabled

Interpret absence of access grants as a "don't care", rather than a "deny access".

Only applies when two or more content access modules are enabled and one of the modules makes no statement about a node that is about to be accessed. If this box is checked, then a content access module saying nothing (via the node_access table) about the node in question will be deemed to be ok with the user having access to it. If not checked (i.e. "strict"), then a module saying nothing will be taken as a "deny access".

Very glad for advice, and if there is no know way of prioritising TAC, I
will push this over to Module Grants as a feature or support request.