Let's take a step back here. You are adding and removing users from what seems like, at most, a handful of groups. Given your example, I can't imagine it would be very "process intensive" to calculate the 3 changes you propose. (If the checked groups list is only 4 items long and the existing list is 5 items long, I wouldn't even worry about iterating over them a couple times to calculate a couple change lists. Heck, even if each list was 100 items a piece, I doubt you would notice a difference unless you are using some awful access algorithm. On top of that, most of the built-in LINQ methods and built-in collections will handle all this just fine.) As always, don't assume what will be "too process intensive". Measure it.
The thing that will probably hurt you more would be making a lot of external calls to Active Directory (just a guess, test to be sure). So if you are really worried about it, minimize those calls. I would much rather make the 3 calls to make the changes than wipe the slate clean then add back 4 groups.
On top of that, deleting a whole slew of records just to add them back can create a headache for audit trails, etc. (It may not matter with AD, but in general it's probably not a good idea.) Imagine trying to figure out when a user was removed from a group. I mean really removed, not just that someone played with the edit groups page.
Also, consider this. Since AD is probably used to control access to a lot of things, there are many applications using it while you are. What could happen to those apps if a user suddenly loses access? What if those apps cache permissions and they happen to hit AD between when you wipe out the groups and re-add them? Also, imagine the fun of trying to do root cause analysis on an intermittent bug in a totally unrelated app when Sarah in accounting on occasion can't do her job because she lost AD access at the wrong time (and by the time you get to it everything will look fine and be unreproducable).
The point is, wiping it all clean then starting over is probably a lazy way of doing it. Unless you have a measurable justification for doing it and are ok with the risks, just write the few extra lines of code.