The guardian shortcut "get_objects_for_user" uses accept_global_perms=True as default, which means that if you have a group that has view permission for ModelClass, and then filter on the objects, you will get ALL objects.

Easy way to fix this is to return guardian.shortcuts.get_objects_for_user(user, permission, queryset, accept_global_perms=False) instead.