There's no usergroup or view access level restriction on joining groups. Open groups can be joined by any active user. Approval groups any active user can request to join. Invite groups users can only join if they've been invited to. To limit it to a view access level you'd need to set that view access level of that groups category, but they won't be able to even see the group or its category in that case.

I suppose you could use a Redirect action on gj_onBeforeJoinGroup in CB Auto Actions and redirect away if they don't have the appropriate access. That should interrupt the join process.

The Type needs to be Redirect. You can then specify the URL to redirect to. As is you're just telling it to execute it self and will get stuck in a loop. The rest of the configuration looks correct.