As what seems to be a standard workflow, we invite users to our organizational ArcGIS Online account simply by using their network email with ADFS authentication. This is a very simple way to add a new user, set the type, set the add-on licensing, and set the groups all in one. Sadly, this option is not available using portal UI. It would be great to see this implemented...having users join automatically in our case is not a viable option at this point.
Thanks for reading!