Define user groups as virtual resources and then realize them later

This should avoid the problem where resources are declared more than once