An exception is a permission granted or denied to one person, on top of what their workgroups grant.
The workgroup is the rule. This is the exception, and it reads best when it stays that way.
Granted and denied
Granted adds a permission the member's workgroups do not give them. It is "this one person also does X" without inventing a workgroup of one.
Denied removes a permission a workgroup does give them. It is "everyone on this desk except the new starter", which no amount of workgroup design expresses.
A denial always wins. It is applied last, so it still bites when a second workgroup would otherwise have granted the permission — and it wins over a grant in the same list.
The Administrator dead end
If any of the member's workgroups carries Administrator, exceptions cannot restrict them. Administrator implies every permission, and the platform succeeds on it before it looks at anything else. A "deny" against an administrator is silently ineffective — the row will sit there looking like it is doing something.
To restrict somebody, take them out of the workgroup that grants Administrator.
When to use one, and when not
A good use: one person, one genuinely unusual need, and no prospect of a second person needing the same thing. A contractor who may read the fleet but not edit it. Somebody covering a duty for a fortnight.
A smell: three people with the same exception. That is a workgroup you have not created yet, and the exceptions will drift apart the first time somebody edits one and not the others.
The cost of an exception is that it is invisible from the workgroup. Somebody reading your Workgroups page will not see it. That is fine for two or three; it is not fine for thirty.