With this option you can restrict the access to the XML-RPC backend. You can list multiple user or group names1) separated by commas. This option just limit the access to the API backend (except the login method). ACLs are still checked when the called methods run of course.
!!notset!!@ to group names