Deny to revoke roles from <User.Group.0*> groups for everyone except Admin team

Question

I need to create a Google Org Policy that would prohibit revoking bound roles only for specific PrincipalSet (Group): User.Group.0* in IAM at the organisation level, but allow it for PrincipalSet (Group): Admin Group

In other words, what would protect UserGroup0* groups from being able to revoke their bound roles in IAM by someone other than administrators. I.e. even UserGroup0* members with rights could not revoke roles, only Admin Group.

Can I implement this through Google Org Policy? Is it possible to write such a condition?

Or to implement this scenario, would I be better off creating a deny policy in IAM and deny everyone except PrincipalSet (Group): Admin Group? from using role management rights.

I have tried to write a condition that describes my scenario, but I lack the knowledge and understanding to do so.

Here is my policy:

enter image description here

That's my condition:

resource.bindings.all(binding, binding.members.all(member,!(MemberSubjectStartsWith(member, ['group:User.Group.0']) && !(authorizer.principal == 'group:Admin.Group.@example.com'))))