Making a hidden group C, which automatically adds members from group A and B is the way to go.
If you handle complex groups and categories permissions you will eventually want to pass this information over from the system who manages that via Single Sign On. Using that you can automate logic like this on the SSO service.