fix(settings): only provide groups the subadmin has access to

fix(settings): only provide groups the subadmin has access to #17214