We went with explicit  policy in the person doc.   All depends,    With groups you will need to be careful of group size and have to create groups within the groups and manage that,

Assigning a policy at the time of user creation is essentially the same as assigning one to an existing user.  This feature is ther as a "time saving" feature for the Administrators, so that they do not have to go back and assign a policy after the user has been created.  by assgning mandatory polcies when creating users, you ensure that the users are properly governed byu the correct policies.