Can't say for sure because I haven't tried it, but the Admin Help (

A secondary NAB to house the \web users (and don't give the \Insiders any access in the ACL). To block the address dialog from picking up those names, use an xACL against it as well.... Might turn out to be the best option.
Then again, this one's only theory. xACL against the Primary NAB works just fine. ;-)