i found a solution together with my colleague - POWERCLI!!!
Get-VIPermission -Principal "User/Group name" | FL
EntityId : Datacenter-datacenter-XXXX
Entity : User/Group name
Role : Role Name
Principal : User/Group name
Propagate : True
IsGroup : True
There you can see the EntityID / Entity and Principal for the group also the orphand one will show up.
Get-VIPermission -Principal "User/Group name" | Remove-VIPermission
Removing permission on entity 'Datacenter-datacenter-XXXX' for principal 'User/Group name' and role 'Role Name'
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"):
So you can verify the EntityId and delete your orphaned one and ignore the rest.