Manual:$wgRemoveGroups

Details
If a group can remove any right (example: bureaucrats can remove any right):

If a group remove only some rights (example: bureaucrats can remove only sysop and bot groups):

Note that groups which may only grant some rights (like bureaucrats in this example) need to have set userrights privilege to false, otherwise they will still be able to add all groups.