Yes you do need to check the permissions in your Ajax-handling code.
The way you would do this would be to follow the pattern in the Joomla MVC FormController, where it uses the Joomla User authorise method, eg, to check if a user can create an article:
$user = Factory::getUser();
authorise() returns true ...
In fact, Setting 2 would only make sense to me if you..
...Have no inheritance of permissions to the top
...Only one usergroup has access to a specific task
Then it makes sense, if the superuser should simply have all tasks / views / options of the custom 1/2 groups this can be solved by inheritance in a cleaner way.
Edit: indeed superuser has no inherited ...
User Group is for grouping users. Viewing Access level is to define what a User Group can access.
So, everytime you create a new User Group you need to link that new group to an Viewing Access Level.
Oppositely, when you create a new Viewing Access Level, you need to assign a User Group to that new Viewing Access Level, so then any item created with that ...