Marco, your original question states what are the minimum permissions to manage a users permissions that comes in from Active Directory (AD) groups and log-in; the minimum is almost nothing. From my experience, adding a Public Role to the database, everyone should be able to connect to the database and see all the feature classes/tables in the SQL Enterprise Geodatabase.
From my experience, for editor's connecting to the SQL database with authentication from an AD Group, only db_datareader Database role membership is granted to that AD Group and I then control their edit rights using ArcCatalog granting Select, Insert, Update, Delete to the specific feature classes or feature dataset. For the users that you want only to view data, from my experience, that AD Group is not granted any Database role membership and as long as the Public Role granted to the database, the AD user or groups can see the entire database because of the Public Role. If you have to sub-divide off certain Read-Only feature classes to certain AD users; you will have to do more work to set Database role membership in SQL Database to certain AD groups.
Brian
