We store our users in LDAP, alongside some groups that have meaning across different systems (organizational roles including wheel). There are also groups local to workstations, e.g. audio or video ...
For convenience reasons I tend to assign special group memberships like floppy, audio, plugdev, video etc. via /etc/security/group.conf (pam_group.so) mechanism instead of adding all users to this ...