Ok, i understand, it is my fault, i didn't see the "Default group" listbox in the "user" page.
I just couldn't move user "user1" from the group "users" because the "users" group was it's default group.
Maybe a dialog box saying "you cannot remove this user from this group because it is it's default group" should have put me on the way... (Even if it is obvious, the doc do not speak about this feature).

But this feature is really improved in DSS compared to NAS-XSR, nice.
Some problems i had solved by resetting ACL will go away with the "Default group" feature.

Thanks.