Maybe you can set the global setting to "any" and then try restricting that user?