What is the easies way to hide certain documents types for specific roles in a contexts?

Very easy to get tangled in knots if not approached carefully.

Agree that in general, using DENY (or possibly but not likely ABSOLUTE DENY) will work, when applied by Role and object type.

But, consider scalability if more types / sub types are added in the future.

Make a careful diagram of the permissions given to WTDocument and all sub types.  Deny at any point in that structure applies below it.

Advise only DENYING READ, or possibly DOWNLOAD.  It might suit the purpose (don't know) to allow users to be aware that these documents exist but not be able to download them.

Worth keeping very good diagrams / spreadsheets, assuming you win the lottery and leave and someone has to pick up what is in place and be able to move forward with it.

Note: Assume any given user can belong to multiple Roles in the context and test what happens.  DENY is like multiply by zero, so it wipes out Granting.

Also, decide whether these ACL's are applied in each Product/Library or at Org level. If at Org level, the don't apply to Private contexts.

Really good puzzle 🙂