Documentation says that multiple groups can be added to per-repository constraints. It does not work. The filter to LDAP looks like this:
"(&(cn=staff, customers)(objectClass=groupOfNames))"

And because of CWD-356, the access to the repository is granted to anyone.