On my site, we had a moderator who had inadvertently not been granted moderation rights. So people were @mention’ing him on posts in the
Staff category, but he couldn’t see those posts. I’m not sure if he was notified by email or what he did see when viewing such a post, but since he didn’t have access to the whole category, it clearly wouldn’t work.
I have some other private categories, and this seems like the kind of thing that could easily get messed up. If you start to @mention someone, all users seem to appear in the list, even ones who don’t have access. I think it would be much safer to show the popup user list and include all users, but visually indicate in the list when a user doesn’t have access, so you’re forced to rethink what you’re doing (either grant access, or post somewhere else, or PM them).