You have created a default user group.
You have added the default user group to the authorization roles of the appropriate user administrators.
Users with no user group for authorization assigned can be changed by any user administrator in the system. It is impossible to segregate responsibilities for such users. To avoid such situations, make the user group for authorization checks a required entry for new users. With this customizing option, you also define default user group, which the system automatically enters when you create a user.
This customizing is client-specific.
SAP Note 1663177 SU01: User group as required entry field
Interaction of Required User Groups and Central User Administration