This is the path I have now decided on. Discourse with SSO in the “foreground” and Nextcloud and its group permissions in the “background”. Nextcloud must manage without actual user permissions.
I will report on how it goes. I’ll look at the app again!
Thank you very much!