maybe i am not doing it correct but if the activiti:assignee is used with an expression e.g. ${assignee} than it is possible that the task is assigned to an user that has not one of the candidate groups? Does the expression have to check this because there is no exception from activiti?
It is not related in your scenario. Regardless on assignee is dynamic or static like 'kermit' the task is 'assigned' - also regardless on value of other parameter like candidateUser or candidatesGroup. The two latest allow a candidate to claim the task when the first just assign.
Any task may have only assignee or only candidateUser or only candidateGroup or all of them. I.e. some assignee may 'unclaim' the task leaving some among candidates to claim the task and complete. The assignee may but doesn't need to belong to candidate list or groups.
Tasks can indeed be assigned to users that are not a member of the candidate groups mentioned on the usertask definition. The candidate groups can be dynamic too.