I have a Modern SharePoint Team site that has read permissions for the domain group "Everyone except external users" and edit permissions for specific groups. I have created several document libraries within this site and have done the usual when setting up permissions: stop inheriting, grant permissions, select AD group, select permission level, share. I managed to get a user that falls into the "Everyone except external users" group to test out the site. He was able to access the site AND the document libraries I thought I had locked down... I went back and checked the permissions and he shouldn't have had access.
Any ideas as to what setting I'm missing here? Or do Modern SharePoint site permissions always over-rule document library permissions (despite stopping the inherited permissions)?