Your current rules seem to work for me:
When I’m logged in, I can get to /rates:
When I’m not logged in, I cannot get to /rates- only https://moonface.netlify.app/
I did this by creating a Netlify CMS user. So, note that whatever roles are set by creating a Netlify CMS user also seem to grant access to the /rates page, not sure if that’s intended or not.