Group Best Practices

I have always developed security using two group types, Position Groups, in which users who hold that position are added directly (ex: Case Managers), and Position Groups, where position groups are added to control their access within the application (ex: Account Creation Case Reviewers).  

Can someone summarize the pros and cons of this method of security for a very complex application with many groups, but very few users for each group?  What would be the downside of adding users directly to role groups?