Deny access for Authenticated Users
If you give a permission to the Authenticated User role, you grant that permission to all other logged-in roles. It works like this because all logged-in users get that role.

However, as long as you don't grant a permission specifically to the Authenticated User role, you can pick and choose which individual logged-in roles to give the permission to. Then you can also give the permission to the Anonymous User role.