By the way: The necessary client should be in both groups (in the example "Java" and "clients")? I thought the group "java" inherits all approvals from the upper group "clients"?
That is correct. The subgroup does inherit update approvals, and you could simply move the client from the parent group to the "Java" group.
How do I ignore updates on a group? Or do you mean I have to ignore this behavior, that updates I don't want to install are showing yellow?
I'm saying that if you use the correct update package, only the clients that have Java already installed will report the update as NotInstalled. The clients that do not have Java installed will report the update as NotApplicable.