How to restrict WI visibility to teams but also allow a special group read only access to all WI

 To set the restricted access attribute you could use a JavaScript default value or a follow up action. 

Thanks for the feedback. I'm not sure the access group will allow us to control our access the way we need to, however. Here is our scenario:

TeamA
      ----TeamB
                ----TeamC

TeamD
      ----TeamE
                ----TeamF

TeamA can only see its own work items.
TeamB can see TeamA and its own work items.
TeamC can see all work items from TeamA, B, C, D, E, F. (overseeing team)

TeamD can only see its own work items.
TeamE can see TeamD and its own work items.
TeamF can see all work items from TeamA, B, C, D, E, F. (overseeing team)

etc..

In this scenario, if we put say members of TeamA and TeamC in an access group, then TeamB will not be able to see TeamA work items. And if we put TeamB and TeamC in an access group, then neither TeamB nor TeamC can see TeamA work items. I can't think of a way to divide up to meet our requirement.

If we use categories, we can create these teams in a hierarchy, so that TeamC can see TeamB and TeamA work items, and TeamB can see TeamA and TeamB work items, and TeamC can see everyone's work items.

But the problem is we need to create a new TeamF with the same users as TeamC to make this work with categories. That means a LOT of extra team areas. We'd love to put those users in e.g. an access group separately which provides access to all work items.. but we can't do category based permissions and access group permissions at the same time (AFAIK).

Not sure how clear that is. Is this scenario possible?

 You can either use the built in restriction based on categories, or you use access groups.