By default the Users group is included on the IIS inetpub directory with Read & execute permissions.
These default permissions can be tightened.
For this change any of the groups: USERS, AUTHENTICATED USERS, or IUSR will work, however IUSR is considered the least privileged and therefore the most secure.
The least privileges needed are:
Basic - Read
or
Advanced - List folder / read data; Read extended attributes; Read permissions
Individual users or groups can not be used in place of one of these special purpose groups because IIS recognizes these groups and treats them differently.