Thanks for the reply, this helps with regards the AD attributes mapping to the person record, but not with the group memberships. These still get reset on the Person record to what they are on the Template - in our case, nothing selected - when there's any update.
On our Test system, I've just tried out setting the AD group mapping which I am the only person in, to the On creation or update setting; I've ran a sync and I've lost all of the IPK and Workflow groups my Person record was a member of.
I really wanted it to just update any AD attribute that may have updated, job title etc, but not touch the Persons group memberships.
Unless anyone has any other suggestions, I guess we'll just have to manually set-up people as Officers from now on if they are already Customers.