Indeed, VSM Person IPK and Workflow groups membership comes from a person template. The system really missing the feature to map person's groups according to AD groups.
Still if you don't have many variations of officer group assignments you can prepare a separate template for each assignment combination and to map each template to a different AD group within Integration settings. Then you should assign AD user to a corresponding AD group without changing anything in VSM.
Btw we are using this approach in our environment so there is no need to manage VSM users manually at all.