Maybe it would help to see this diagrammatically:
What I was hoping was to set at (1) (System) level:
(Grey boxes are categories)
Module Leader: block/ilp:viewotherilp Not Set (so the default of not seeing any courses in my course groups from any category would apply)
Student: block/ilp:reviewee Not Set (again - so that they will by default not appear on "my course group" lists for any courses)
Then at (2) (The top level category for the tutors courses) to set both of these to Allow, so that only for courses inside these categories would My Course Groups be created and student appear on them.