Like Lua's limitation is also its advantage, Groovy's advantage is also its limitation. If you want to tightly control what the user can and can't do, Lua is a clear winner here since they won't be able to do anything you don't specifically let them. (The downside being that you have to specifically allow everything you want to allow, basically.) Groovy is Java... so it has access to everything a Java class does.
ScriptEngine groovy = new ScriptEngineManager().getEngineByName("groovy"); // standard java
groovy.eval("println 'Hello world'");