It sounds like you're wishing for a "hide post if any categories unreadable" behavior. But Role Scoper works the other way - "show post if any categories readable". You can't use tags to define restrictions, for similar reasons.

To restrict a specific post below the visibility it would have with its regular categories, you have two options - both accessible via the Edit Post form:

1. Set the post visibility to Private. For best security, you should do this even if using method 2 below. Marking the post private hides it by default, and also allows you to grant read access to premium subscribers by assigning them a Private Post Reader role - either blog-wide via Roles > General or per-category via Roles > Category.

2. In the "Readers" metabox, select "Restrict for Post", and also select the Group for your Subscribers.

Regarding category selection for permalink… Maybe in the future, a plugin could let you control the priority order when a post has more than one category. Until then, an ugly hack if you really need to adjust that would be to manually modify the term_id and term_taxonomy for "CategorySubscriber" in the terms, term_taxonomy and term_relationships tables.