I think yes in this configuration above, the users who are not in the Windchill_Users will have login permission, but they would not be able to login as the Login is only for the users in the Windchill_Users group.
This cant be prevented, as per the Group structure you have.