Dynamic RLS and all access

I think the short answer is, yes, you have to add a "No RLS" security group to put them in. Make sure that anyone you have in "No RLS" is not also in any other RLS group.

There is a longer answer if your scenario is:

1. you are adding all users (via distribution list email, security group, etc.) to a single dynamic RLS group that leverages USERNAME/USERPRINCIPALNAME against a Users table
   AND
2. your Users table only includes people with some kind of restriction, but people who are in the RLS group but not in the Users table should see all rows

In this case, you can create a measure that returns TRUE if the current user is NOT in the Users table, and then just add that to your RLS conditions with an OR.

Example:

Say you have a simple dynamic RLS model like so:

With RLS set up like this:

Then you can create the following measure:

Super User Check = 
CALCULATE(
    ISEMPTY( Users ),
    TREATAS( { USERPRINCIPALNAME() }, Users[User] ),
    REMOVEFILTERS( Users )
)

And update your RLS accordingly:

Remember, everyone still needs to be added to Dyn RLS in your dataset security settings on the service.