Yes. That will work. But if he cheks what group does the user belong to, he will discover that the user is in the admin group...
I think that the best way is to set the rights one by one instead of adding the user to the admin group. Or give the restricted users group some admin rights...
(If you find any mistake in my English, please let me know via a PM)
(Really, I speak terrible English, so please, tell me if I make mistakes. I'd like to improve it a bit )