I may be dealing with a similar problem on my side (version 4.10.1). I found out that access control is basically not used at all when I use authentication keys. I have an access group assigned to the authentication key, and if the user is in that group, it works even if the user is restricted through access control.
At the same time, I have another issue: when I add another group (nested group) into the group assigned to the key, the user is not recognized.