To me this feels like a feature request which involves changes to the way we communicate this feature as well.
We currently only talk about adding to a group, not removing.
If we start auto removing
- We need to communicate upfront that this happens in our help text
- We need to clearly define what happens to users that are manually added to the group. (do they get automatically kicked out, how does the admin know the feature is working - do we flag them in the UI)
As a workaround for the missing feature I would recommend regular audits using a data explorer query.