Security is a rather comprehensive subject and of course extremely important.
I recommend you subscribe (if you haven't yet) to the precision LMS course at least on Security and Visibility.
Run time and Design time access is for Permissions, not visibility. For that you need to utilize Organizations and Visibility permissions.
as Pai mentioned, you have to create a new organization, add your groups to it, add your users to the groups, then add your organization to the Visibility section of your mashup.
At the end of the process you will see your new organization in the Visibility section of your mashup.
At this point your user can see the mashup.