It looks like you have to go into the CLI as the root user and add the capabilities for that particular group. Below is an example of adding capabilities to a group.
DOT version: 8.0.2p5
api-aggr-check-spare-low,api-aggr-list-info,api-cifs-homedir-paths-get,api-cifs-list-config,api-cifs-top-iter-*,api-cifs-session-list-iter-*,api-cifs-share-list-iter-*,api-cifs-status,api-disk-list-info,api-disk-sanown-list-info,api-file-get-file-info,api-file-list-directory-iter-*,api-file-read-file,api-igroup-list-info,api-iscsi-initiator-auth-list-info,api-iscsi-initiator-get-default-auth,api-iscsi-interface-list-info,api-iscsi-node-get-name,api-iscsi-portal-list-info,api-iscsi-service-status,api-iscsi-target-alias-get-alias,api-iscsi-tpgroup-list-info,api-license-list-info,api-lun-get-comment,api-lun-initiator-list-map-info,api-lun-list-info,api-lun-map-list-info,api-nfs-exportfs-list-rules-2,api-nfs-status,api-options-get,api-options-list-info,api-options-set,api-qtree-list-iter-*,api-registry-get,api-registry-list-info,api-snapmirror-get-status,api-snapmirror-list-connections,api-snapmirror-list-schedule,api-snapshot-autodelete-list-info,api-snapshot-list-info,api-snmp-get,api-snmp-status,api-system-cli,api-system-get-*,api-useradmin-group-list,api-useradmin-role-list,api-useradmin-user-list,api-volume-autosize-get,api-volume-get-language,api-volume-get-root-name,api-volume-list-info,api-volume-options-list-info,cli-cifs,cli-date,cli-ifconfig,cli-priv,cli-stty,cli-timezone,cli-uptime,login-http-admin,security-priv-advanced
