Yes. When you federate your GIS server with a Portal instance, you're delegating security to the Portal. Portal has a concept of users, roles, and groups. You may create all three. A role is more a collection of priviliges, and a group is a logical collection of portal items that is themselves shared with a number of users. Basically, when you federate, use Portal to manage your users, groups, and roles. Once you've federated, the GIS Server passes that functional aspect to the Portal.
https://enterprise.arcgis.com/en/portal/latest/administer/windows/roles.htm
https://enterprise.arcgis.com/en/portal/latest/administer/windows/create-groups.htm
