Clarify the meaning of an empty vm user or group list

The API doc said that the default list returned is an empty list
of users and groups, but that could have been interpreted as no
restrictions, or nothing at all had access. Adding two lines
to clarify who can access a vm by default.

Signed-off-by: Christy Perez <christy@linux.vnet.ibm.com>