In /etc/login.defs SU_WHEEL_ONLY YES should allow only members of group wheel to su to root. However, this does not work. My user is not a member of the wheel group and yet he still can login to root.
RH is using /bin/login from util-linux and not from shadow-utils, so not full functionality from shadow-utils is guaranteed.
Comment 1: Agreed. Closing as not a bug, as we prefer behavior from util-linux.