Add "Blacklist Groupprovisioning" to prevent creation on certain groups

How to use GitHub

• Please use the 👍 reaction to show that you are interested into the same feature.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Feature request

Which Nextcloud Version are you currently using: 31.09

Is your feature request related to a problem? Please describe.
We have one group in the Idp which acts as "permitted-nextcloud-user". Every user in that group is allowed to login to Nextcloud. In addition to that group some users have additional groups like "Marketing" or "Engineering" but not all user have to be in an additional group which means I need to whitelist the "permitted-nextcloud-user" as well. Now the problem we face is, that it creates that "permitted-nextcloud-user" group which contains ALL users. This is disastrous and we cannot allow this group to exist in Nextcloud and made availible to be used to share folders/files with. Imagine someone sharing a file with 15000 users by "accident". The user itself is still allowed and provisioned when he is in that group, even if it is the sole group and i no additianl group. The group itself is not created nor assigned (well, there is no such group to assign to then)
My Google search tells me I'm not the only one with that issue.

Describe the solution you'd like
There is no need to change the current Whitelist mechanism. We need an additional field in the configuration - "Blacklist Groupprovisioning" (regexp would be most flexible). Any group that matches this filed is then not provisioned as a group but the rest of the flow is unchanged, user ist still allowed/added. This would allow to not create the All-Users group but we can still use it in the whitelist field to allow a login.

Describe alternatives you've considered
This is NOT as important as the requirement above: as a bonus, that groupblacklist also applies the other way round. It will not delete groups that were added manually to an account in Nextcloud. It is a global "ignore this group"

Additional context
None

EDIT: Typo, clearification of strange sentence and added "bonus" under alternatives.

Start by locating the existing whitelist configuration and the group-provisioning flow. Trace how whitelisted groups are used for login while being created in Nextcloud, then determine where a regexp-based blacklist would leave users allowed but prevent group provisioning. Done means the new configuration is documented and the requested group behavior is covered by tests.