The correct setting is Restricted site access configured with Group1 . Microsoft Learn states that you can restrict access to a SharePoint site by specifying Microsoft Entra security groups or Microsoft 365 groups as the Restricted Access Control group . Microsoft also states that, after the policy is applied, a user can access the site content only if the user both already has permission to the site or content and is a member of the specified restricted access group. This exactly matches the requirement: users who currently have access to Site1 must also be members of Group1 to continue accessing the content.

The Restrict content from Microsoft 365 Copilot setting is unrelated to direct user access to the SharePoint site. That control limits whether Copilot can use site content, but it does not block users from opening the site themselves. Microsoft separately explains that Restricted SharePoint Search and Copilot restrictions are not the same as changing actual SharePoint permissions or access boundaries. So for this scenario, keep the Copilot restriction Off and configure Restricted site access with Group1 .