I was able to find out the answer to this. As I said, I am new to RLS and all the examples that I was seeing where for the most part User1 being part of only one AD group and seeing all the records for the given criteria. 

In my particular case, the issue was my coding the function incorrectly. The client column is actually an integer and the AD group name has leading zeros when the client is less than 5 characters long. I had forgotten to pad with 0s when dynamically concatenating the client id to the AD group name, i.e. This Users_00123 means something different than Users_123, so this failed as a check: IS_MEMBER('Users_123') = 1. Once I started padding with the leading 0s, that check was successful and all worked fine.

Evgeny, thanks for the feedback!