While you could in theory use any database-backend with custom NSS/PAM integration using a LDAP server is the right solution because there are ready-to-use solutions.
I repeat my answer to How to only allow users and/or groups access certain client machines that are connected to an openldap server?:
That's pretty much the use-case my own solution was designed for, completely based on free software:
Æ-DIR -- Authorized Entities Directory
Mainly systems/services are members of service groups and you define which user groups have login right to the service group.
It's a bit of indirection implemented with OpenLDAP ACLs granting read access to users and groups and especially user attributes needed for login. To avoid a common misunderstanding: You will just maintain LDAP entries to change access rights; the OpenLDAP ACLs are static.
To be honest there's one thing you have to configure in the LDAP client: A system credential, either bind-DN and password or TLS client cert.
It will take some time to understand the concepts and model the data to match your access control requirements. And pretty sure it will not fulfill all your wishes regarding access control.
P.S.: I'd like to hear of people having large setups with host access control based on netgroups because I'd like to find out whether it would be possible to write an auto-migration tool for converting netgroup maps into Æ-DIR's aeSrvGroup.
FreeIPA has similar goals and they implement so-called HBAC policies and some more to achieve that. From my understanding you would have to use sssd with IPA backend to make use of the full feature set. sssd is the policy enforcement point.
Sorry, I'm not familiar enough with their online docs and thus don't have good documenation links at hand besides the FreeIPA docs overview.