You should read the documentation on Permissions (if you haven't already), but to recap there are basically 3 levels or permissions:
Object will override category permissions and category will override global permissions.
There are different ways you can approach this particular security issue, in other words multiple correct answers!
The easiest is probably to set the user group permissions at the forum (object) level. It is possible to allow specific user groups to access a forum and deny access for other user groups.
Another option is that you could create a category that has forum permissions for a particular user group (or multiple user groups) and then assign each needed forum with that category.
This nice thing about the category approach is that you can assign one user group per category and then assign multiple categories to each forum so that you can very easily change permissions on forums by adding/removing categories.