Once the EMS is successfully connected, depending on the permission settings, all of the REST API is accessible, so you can use services in the model to create the group.
BEST PRACTICE!!!: Create a Service ahead of time that the EMS is allowed to invoke, which will do what is required. Do NOT allow your EMS to invoke actual Entity Services!!!