Default permissions are inherited from the parent, so any time you default grant it's difficult to override that setting and remove it. Grant trumps deny pretty much every time in my experience.
You should start with default as deny, then grant using roles if you want to do this. And I would recommend NOT setting the posting permissions to default grant at the community level because it creates a host of problems.
Put the community-wide default as deny and then you can default grant to anonymous users at the category and board levels. It's tough to make a more explicit recommendation without seeing how you've set things up. I hope this helps a bit, though.
lolagoetz if I were to create an 'anonymous' role, how would I add anonymous users to that role?
You don't have to add them to a role, you just let the permissions at the category level grant it to them. You just don't want to put default grant at the community level because it causes cascading problems (including the verified users you mentioned).
This is really complicated to explain without seeing what your default settings are at the community level and then at the other nodes.
If you want to reach out, I may be able to provide some more guidance offline.
