You are correct. The site role works as a ceiling on the permissions a user can have (in other words, it represents the maximum, as you have said). It's labeled as minimum on the Group because once a user that is part of an AD group has been imported to Tableau Server, the role of that individual user can be increased (i.e. promoted) but not decreased below the group minimum.
There are more details here: Synchronize Active Directory Groups in a Site
Hope this helps!