Thanks for the suggestion! I think this would probably work, although there is still the problem that (depending on the delay) the user might not be in the right groups immediately after login.
The problem I am facing is that many of our users seem to give up when they don’t see what they expect to see right away. Most of our categories require group memberships, and when people don’t get what they expect right away, they seem very quick to conclude that the forum is broken and give up. They don’t wait, they don’t read the instructions, they just move on.
Also, I agree with @daybreaker that this just seems to be something that should have builtin support in Discourse SSO.