Your SSO can pass a group membership parameter via the DiscourseConnect response in the SSO flow. That way your SSO Provider can give this (and others) groups memberships.
It’s documented at DiscourseConnect - Official Single-Sign-On for Discourse (sso)