Event Roles (aka Shifts) are what the volunteer actually signs up for.  An event can have any number of roles. Those roles can be restricted to certain volunteers and/or groups. When you create the volunteer role, you can make it public, available to all users, or restricted. If the role is restricted, the user must be in an associated group before they can see the role. 

First create an event and add the role (Events and Manage then Create).  After your event is created, you will need to add roles to the event.  Adding a new role (not selected by search suggest) will have Public as the default privacy.  Roles are used across events, so by changing the privacy on a role, it affects that role on all events with the role.  To change a role to be restricted (or require access) you can change the role privacy under Events and Event Roles.  Note: If you changed the name of "Event Roles" to be Spots, Opportunity, Shifts -that is the name in the list under the dropdown.  Find your role in the list and click on it.  There you should see a privacy dropdown.  Change it to Restricted to restrict the role to only users in certain groups.

At this point you have an event, with a role which is restricted.  Now you need to give specific users the ability to see and sign up for the role.  So you need to create a group (In the nav bar go to Users and Groups).  Create a group (ideally called something like Volunteers.  Do not assign access to that group.  After the group is created, go into the detail and click on the Allowed Roles on the side bar when viewing the group.  There you can assign the roles this group is allowed to sign up for.    Now any users within that group will see those restricted roles on an event!