I'm configuring SSO and would like to designate access level based on an AD group we assign the user, how is it best to go about this?

I guess this is a slight variation on a theme to this question: https://one.workfront.com/s/question/0D54X00006QK7A3SAL/how-do-i-use-active-directory-security-groups-to-restrict-access-to-users-authenticating-via-sso

Effectively, I'd like to make my domain users reviewer or requestor access as a default but then add special groups for granting plan or worker licenses.

Could someone help point me in the right direction please?