Hello!
You can use the Power BI Rest Api to get a list of users that have access to a specified workspace and also the access right as well. Additionally you can perform operations like adding a user or deleting a user from a workspace. You can find more information here: https://learn.microsoft.com/en-us/rest/api/power-bi/groups/get-group-users
Additionally, according to documentation you can check (must have admin rights) what are the different sensitivity labels on different items in the workspace, such as reports, datasets etc. You can check the documentation here: https://learn.microsoft.com/en-us/power-bi/enterprise/service-security-apply-data-sensitivity-labels
One quick thought about your problem is assigning sensitivity labels to your groups in Active Directory and then according to that and the sensitivity labels that have been set for Power BI, do the necessary operations.
