Catalogs are only accesible from the workspaces which they are bound to, so the metastore admin wont be able to access them from all the workspaces. It is a best practice to have an empty group as metastore admin to avoid having some one too much power like you were alluding to. Once the catalogs are created ownership can be transferred to a admin group like data owners to govern themselves. You can always add members to the empty metastore admin group in break glass situations.