AllowGroups sshusers
AllowUsers localUser@192.168.2.* # 2 is not a typo
# localUser not in group sshusers. Intention: AllowUsers should override
# previous configuration, allowing access for localUser, even if he is
# not member of sshusers

AllowGroups sshusers
DenyUsers localUser@!192.168.2.*
# localUser is member of sshusers. Intention: Access is granted, but with
# the negotiation of the match-expression for the LAN, access should be
# denied for external login.
# Also tried "!localUser@192.168.2.*"

# localUser member of sshusers
AllowGroups sshusers
DenyUsers localUser@192.168.2.*

AllowGroups sshusers
DenyUsers localuser@!192.168.2.*,

DenyUsers localuser@!192.168.2.*,!10.8.0.*,