Your company uses management groups to manage resources in your Azure tenant more efficiently. User1 should be able to assign access and assign policies to management groups. You need to determine to

The User Access Administrator role grants the ability to manage user access to Azure resources, specifically allowing the assignment of RBAC roles. While it doesn't directly assign policies, it allows User1 to assign other roles, such as Policy Contributor, to themselves or others, thereby enabling policy assignment indirectly and adhering to the principle of least privilege.

The Owner role provides full access to all resources and the ability to delegate access, which violates the principle of least privilege as it grants more permissions than required.

The Management Group Contributor role can manage management groups and their policies, but it does not include the permission to assign RBAC roles (manage access) to others.

The Contributor role can manage most Azure resources but does not have permissions to assign RBAC roles or to directly manage policy assignments at the management group scope.