this is doable using an exclusion: you'd write a relationship removing all users like so:

definition user {}

definition document {
  relation admin: user
  relation restricted: user:*
  relation viewer: user

  permission view = (viewer - restricted) + admin
}