Restricting access to a report part of published app

Hi,

I have an app workspace which has 4 reports and all these reports are part of the app via which users access the reports.  Out of these 4 reports i dont want to share a specific report with an ad group. 
At the report level if i dont give access of Report 4 to Group 2 will that work or will app access superceed the workspace access ? if yes than how do i restrict the access of "Report 4" to Group 2 (which also has app access) ?