ipagroup: Fix ensuring external group group members (without trust-ad)