If a client does not have a 'set package' and they go to order through the portal, the restricted group is still shown to them. This happens as soon as you click the 'order' link in the client nav bar. If a client continues further by clicking that group and then clicking 'skip, order other items', the group finally goes away. IMO, this group should never show when the client clicks 'order' initially.
Also a client who is authorized to order a restricted package, still can't order it through the portal. Ignore this. I was thrown off because they are sent to the domain lookup field first.