Sitecore uses domains for this purpose: https://doc.sitecore.net/sitecore_experience_platform/setting_up_and_maintaining/security_and_administration/users_roles_and_domains/security_domains
You can use security domains to manage user's access to different
parts of Sitecore, for example, if you have multiple websites within a
A Sitecore domain is a collection of security accounts (users and
roles) that you can administer as a unit with common rules and
procedures. A domain is used to collect security accounts that have
some logical relationship, for example, all the accounts that have
access to use the Sitecore clients could be stored in the Sitecore
domain, whereas all the accounts with access to the published website
could be stored in the Extranet domain.
So your users in the shell (Sitecore admin) will not be the same as the users used on the frontend - they will be in a different domain.
Mostly roles are not used over domains, although you should be able to mix roles and domains (and users), but if you would go that way it might become very complex - and probably still impossible for a single user to deny read access in the shell while having read access elsewhere (never mixed these myself).
Edit after comments:
if you need a user to have different rights, you need 2 users (one in each domain). But if this is only to have your editors browse the site while editing, this can be achieved by using another browser or by using an incognito window in Chrome (anything that does not uses the same session actually).