We are not having "much" of an issue with assigning groups and having users on the devices.
We do see that some users dont get synced down to the devices, this seems to be more a function of how muching/how long they get to sync.
In our case we have 70 users assigned to a group at the root of the system tree. The IT users. Once in a while we will find that the user in teh IT group isnt there any longer, this is really the abnormal situation.
But after adding additional groups, large groups mind you 200+ we see users that are not on the device more often. But if we initialize a few updates and monitor the logs, we see them get synced with the device. Since the now 270+ users are not all logging into the device we cant really say how many of those 270 are on the device, but it is abnormal that the users isnt on the device, perhaps we have been lucky so far and statistics are playing in our favor.