To change permissions within an existing group, navigate to the domain root partition (Company Name should display in the top center of your screen). You will make changes to the group’s permission within the Permissions sub-tab in the Group’s record.
Note that if you determine that you wish to manage using all custom groups rather than the default groups, it is recommended you ‘zero out’ permissions for each app in the Domain user group. This ensures users are not getting any permissions by default since users are added to this group automatically upon registration to your domain.