Even if people don’t have permission to create group instances, they can still access them. If someone has a link to an instance, they can use it to invite themselves through the vrchat website. This action will create a new group instance, regardless of their permissions.

For example, anyone with the following link can create a public group instance for my group: https://vrchat.com/home/launch?worldId=wrld_72b30439-62a0-4c0d-a0e6-b3eb7292d355&instanceId=VRCPLSFIXPERMS~group(grp_2b910dc4-e984-4fd5-813c-877edcea29d2)~groupAccessType(public)~region(us)