SQL Server Active Directory login groups with limitation
This is a common issue, you want to use groups to keep things simple but you don't want to lose visibility of who has access to your databases. The way I see it you have two options:


If you trust your AD admins (If you don't you have bigger problems) then use AD groups.
If you don't trust your AD admins then you will have to manage access on a per user level by giving everyone an individual SQL Server login.