Not sure what you mean by "...did the same for the authenticated user role...". I want all authenticated users, except those assigned the "No courses" role to see the courses block. This is much simpler and easier to maintain then deny all authenticated users and then assigning the majority of users to a role that allows them to see the course block.
What it looks like is that permissions for the authenticated user role over-ride all other roles.