What is the role for creating marking groups?
This is not a role in account settings, but is handled in control panel.
Visit control panel → Organization Permissions. By default, the marking creation and manipulation is handled via “Manage marking categories for the organization”
Create a custom role that is has only this ability.
Note that default roles cannot be edited, and “Manage marking categories for the organization” is under Data Governance Officer and Organization Administrator. If the desire is to change this, revised roles should be made to serve these purposes but omit “Manage marking categories for the organization.”
Also confirm that no other custom roles contain “Manage marking categories for the organization” unless desired.