Restricting users to join any one private group

If you use any kind of student management system and use SSO elsewhere, then you can probably manage group membership in your SSO payload. No need for a plugin, or anything else.