You can't unless I guess you force usergroup assignments with CB Auto Actions acting on the after update user trigger. So for example if you've an auto action with usergroup type and you set access to your backend usergroup you could set it so if you save them it always reassigns the backend usergroup, but then you can't demote users. It maybe possible to condition them to see if they're trying to add Registered though. What issue is this causing exactly? Adding Registered shouldn't give them more backend permissions.