SQL integrated security permissions

I have SQL permissions specified as follows:

Database 1:
Group 1:
sysadmin (role)
Group 2:
db_owner
public
Group 3:
db_datareader
public

Group 2 does not have the ability to modify the RDM database. Group 1 does. If Group 2 is added to the sysadmin role the users can make changes to the RDM database.

Are there any other system databases and/or permissions that the users should have to allow changes to the RDM database(s)?

Thanks!