After resetting all permissions.
Just remove Grant values on all permission that your Co-Admin group should not be able to add/remove or change.
Do it on permissions like member add or needed member add power etc (or do it on all, there is no real reason why they shuold change permissions).
And lower his own member add power below Server admins needed member add power.
And do this before you assign the group to anyone!

Or do not assign that group to user that fool you

To get back to thread topic, this thread is about "Reset permissions when user gained permissions and you can not figure out where he has them" and not how does permission system works.
Please create a new or searchfor existing threads for this