I assume that you need to pull the list of users who do not have transactional access (only ESS access)
If my assumption is right ,
1) AGR_USERS , give the input of ESS role in Role field and get the list of users.
2) Give the list of users (from step1) to User field in AGR_USERS again , and selct your ESS role in Role field under 'Exclude single value/range'. Get the list of users.
3) Filter out list2 users from list1 users, You will get the list of users who have only ESS acces.
Thanks,Krishna