Is there a way I can give all Active Directory users read permissions
to all documents on the portal?

I would like all users to have read access but some users get access
denied. I would then like to grant specific denial of access to other
subareas where necessary.

ie everyone has read access but only Human Resources can access
personnel data.