In the latest version of dotnetnuke, you can easily configure an module instance so that certain groups have the right to edit or certain groups the right to view.  These permissions are non-exclusive.  So if a user is member of a role with view permissions and is also member of a role without view permissions, the right to view trumps the lack of rights.

Is it possible to set the permissions exclusively?  So that if a user is member of several roles, and one of the roles as "can not edit" rights on an module instance, that user can't edit it?

I've had an look here (and on snowcovered) but can't find anything which offers such an capability.