Under the User and Device tab for Manage Roles, you can select what groups a role can edit. Once you select Grant for the access, you can list what specific groups this particular role can or cannot edit.

I do not believe you can automatically assign a role during the activation.