Look into jfa-go. I run it on the side and it hard-integrates into Jellyfin and adds a lot of account management stuff and the group/policy specific config you're mentioning

https://github.com/hrfee/jfa-go