We believe the problem may be here.
There is a special default VDC created during the installation that allows the use of ALL the physical resources.
The users group belongs to this VDC, and any new group is automatically added to the default VDC. You can modify the VDC physical resources, even remove all of them, but it can’t be deleted.
Before adding a new group to a specific VDC, you may want to remove it from the default one, since it allows the use of ALL the physical resources.