Currently, user can register group membership nesting under privusergroup security group,although this is unsupportable as follows:

Title: Microsoft Dynamics CRM supported configurations
URL: https://technet.microsoft.com/en-us/library/hh699704(v=crm.7).aspx
---------
Direct user account membership in the Microsoft Dynamics CRM privusergroup security group is required and
group membership nesting under privusergroup currently is not supported. Granting membership to privusergroup
through another security group can cause system-wide failures in the CRM web application and reporting features.
For example, if you add a security group named mycrmprivgroupusers to privusergroup,
members of mycrmprivgroupusers will not resolve as privusergroup members.
This includes the CRMAppPool or the SQL Server Reporting Services service identities.
---------

To avoid confusion and to avoid creating these security group,
Please add the function that user can not register nesting security group.