Hi,
User with Consumer role is able to Manage Permissions and Manage Aspect. Once Manage Permissions are enabled, he's able to add any outside groups not relevant to site.
How I can remove Manage Permissions and Manage Aspects to Consumer, Collaborator and Coordinator keeping it for Site Managers. See the image below