Silly me… I learnt something today: in sshd_config, Match blocks scope ends at next Match directive or end-of-file.
In other words, if you want to set any global setting such as AllowUsers etc. make sure it is set before any Match directive.
Sorry for the noise 
1 Like