If you do not have an Active Directory, you can use the 'group name' reg key available in the Safeconsole install folder\webapps\res\
Edit the file "group name.reg"
By default it is designed to put all users in a group "non domain users". You can change this name and use different copies of the registry key for separate groups of users.
Replace the portion of the string that says 'non domain users' with a name that you choose. It's important that the other portion of the string (the domain name) is retained (NOT CHANGED) since changing this will create a new root domain and it will then be difficult apply policies.
Once you have edited the key you can run it on computers/user accounts prior to connecting devices from them. This will place the devices in the "groups" that are specified in the local registry key.