I think BuddyPress has the same issue we have with Socialcast - once a group is 'public' any member can join the group. Great as long as we have only Sage groups. If we grow into other ERP publishers, we don't necessarily want crossover. For example right now in SC if we had an Intacct group, then they see the Sage groups and the Acumatica group and vice versa. Correct me if I'm wrong @RobertWood.
https://codex.buddypress.org/administrator-guide/group-settings-and-roles/