Yes, that example is correct - just make sure you're indenting stuff with spaces.

If the restrictions are on and they don't have the bypass permissions, they should be subject to them.

Can I see your current global config file? enable-restrictions is a global key and can't be wrapped in a world block. Keep it outside - e.g.

settings:
  enable-restrictions: true

Can you not globally give the bypass permissions and negate them in the kit world?

Restrictions are now done with permissions. Please see the FAQ for more information on how this works. Make sure they're enabled in global.yml first.

You can deny access to the kits by denying the not use permission in that world. To do this, your permissions plugin needs to support this. bPermissions supports this. Simply only grant the kit use permissions in your kit world.

Ideally, yes I'd do it like that. Unfortunately some badly-written permissions plugins (PEX) allow the use of the '*' node which would cause the restrictions to apply to everyone with the node. This would cause yet more GitHub issues from users who can't use their permissions plugin properly.