I am not sure about the current state, but in past, there was a list of allowed groups. The list was forced by the list embedded into the build checks, not by the rpm itself. If it is still true, the list could be extracted from there.