current promotion restriction require to set user names, and don't integrate with security settings. Should accept a group name.