I proceeded to test and find on my own, and I must agree with what you wrote.
Denying a test user any authorizations on the called transaction only granting the calling transaction, after running a dozen test cases, I was able to find that:
WITHOUT clause - Does not check for TSTCA, TCDCOUPLES, and only stops at the hard-coded AUTHORITY-CHECK 'S_TCODE' statement in the called program with RC=4
Omit the clauses WITH/WITHOUT altogether - TSTCA is not checked, but properly maintained TCDCOUPLES and hard-coded checks in called program can come in handy
WITH clause - strongest with all other checks
Thanks again,
Pawan.