Create 'staff' and 'external-users' groups to manage Google Apps and non-Google Apps users, and automatically add / remove users from these groups when synchronising from Gapps.

The admin users should be able to turn this automatic management on and off, and also configure the group names.