Same issue on our side - we tried both (Groups and CP)
From general Groups are evaluated faster - but we ran into second bottleneck - too many Active Directory attributes are import as User attribute. In some cases user has around 900 attributes which only 20 of them are related with Qlik security - however during Log in all of the groups are checked against security rules and we lose performance in HUB opening (around 40s in such cases).
Maybe you found a way to workaround this? Or you have better results with CP evaluation?