Security configuration approaches: Assigning users to Roles vs assigning Roles to User Groups

Hello,

I was wondering if anyone can share their security configuration approach at a high level. There are two approaches that I'm contemplating but having a difficult time to determin the pros and cons of one over the other.

1) Assign privileges to a role and associate users to the roles

2) Assign privileges to a role, assign roles to user groups and associate users to the user groups

I'm hoping to get a sense of what approaches other companies are using regarding configuring security and why? The security we want to put in a place is not that complex meaning not secured fault/data access, no regional/location restrictions, etc.