I've tried many avenues to get the accounts set in "Global Permissions". With "Propagate to children" enabled, of course I can find them further down in objects like DataCenter.
More:
https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Get-VIPermission-How-to-determine-if-permission-is-Global-or/td-p/2818183