ARE YOU KIDDING?
For security, the default group should be read.
The user's group is set in RADIUS.
For additional security, you can create a group completely without policies and put that as default...
This is one example for create one working RADIUS login with v7 user-manager