In their particular case they would not need to manage the users. We do however have this permission turned on for our regular moderators " to " Manage roles, user bans, and abuse notifications in admin and user profiles" at the community level, the only place where is can be set and can't be overwritten below. I made a copy of that role for our special case and turned that option off, but it still appears to be available to them. As for Groups, the user I tested with had the GroupMember role in the group, it was just in the community I cannot see how this user actually gets access to the group. I was going with the default permission settings for Groups.
... View more