'not_allowed' method in group 'invest_methods' does not actually do anything. The name of that method should be 'not_active' indicating that the group investment limits are not active. Group 'invest_methods' are using the same list of choices as unit 'invest_methods' and clearly it should not. Instead of 'not_allowed' the name should be 'not_active'.
Another choice would be to actually remove investments from all units that are part of a group that has 'not_allowed', but I don't think it would be a good idea.