I'm confused about how xenforo implements permissions related to user groups. If I set up a board to be visible only to moderators and administrators, no one can see it unless their primary user group is set to moderating or administrator. If the secondary group is set to those, they cannot see it.
Why is that? What's the point of secondary user groups, anyway, if they have no effect in such cases?
Try it the other way around - make your Admin/Mods forum 'Private' (which flips permissions and effectively sets 'No' for everything making it invisible to anyone without explicit permission to see it) - then give Admin and Moderator usergroups permission to view/post.
The permissions are kinda hard to understand at first. Secondly, your primary group should be set to Registered users, just equip that group with the basic permissions you want your users to have. All others, set to No (not set), do not use never, they actually mean never.
Then for moderators, ignore the basic features, just set them to inherit, but whatever permissions you want your moderators to have you set to allow. Then to add new moderators, just set their secondary groups to moderator, and they will have the new feature set, even if your primary group don't have those permissions. That way you never have to double define permissions again.
As for making the board only viewable to moderators, you could just do as Clickfinity said, make it a private node, then add View node permissions to your moderators. If they cannot see it, it is because you have set one of the other groups, probably registered members, to view node never, which again, means never.
Enabling this allows you to specify Allowed permissions for the groups under that node. The Private node option disables all permissions such that you only need to specify Allowed permissions. This is good for private forums where only a couple groups have access. Otherwise you have to explicitly setup Revoke and Allow permissions for each group which is more work.
Well, this is all most confusingly done, I think. I mean, if I set someone to be "moderating" on secondary group, then that person should see a board that "moderators" are set up to see. But it doesn't work that way.