Role weights not working as expected

I'm afraid you are slightly mixing two things here. Role weight (in the context of ACL) only works together with role inheritance. ACL is then always queried with a single role.
User class does this slightly differently – it doesn't work like inheritance, the ACL is queried for each assigned role sequentially, in the same order they were set in the Identity, and if any of them passes, user is granted the access.

Here is basic implementation of static ACL:

config.neon

services:
        authorizatorFactory: App\Components\AuthorizatorFactory
        authorizator: @authorizatorFactory::create

AuthorizatorFactory.php

<?php

namespace App\Components;

use Nette\Security\Permission;


class AuthorizatorFactory
{
    /**
     * @return \Nette\Security\IAuthorizator
     */
    public function create() {
        $permission = new Permission();

        /* User role definition */
        $permission->addRole('guest');      //--- Anonymous user
        $permission->addRole('customer');   //--- Signed user
        $permission->addRole('admin');      //--- Admin

        /* List of resources */
        $permission->addResource('Admin');      //--- Admin
        $permission->addResource('Homepage');   //--- Articles
        $permission->addResource('Redactor');   //--- Redactor
        $permission->addResource('Shop');       //--- E-shop

        /* Permissions settings */
        $permission->allow('guest', ['Homepage', 'Shop'], ['show']);
        $permission->allow('customer', ['Homepage', 'Shop'], ['show', 'edit']);
        $permission->allow('admin', Permission::ALL, Permission::ALL);
        return $permission;
    }

}

I am afraid with current implementation of Nette\Security\User it is not possible to deny access to some resources by adding a new role to the user. You can only achieve allowing more access by doing this.
Hence the only way to restrict access is to remove some roles from the user.