To update this question, I was able to implement a "no-code" way to prevent users with a particular role from creating incidents that did not have the right assignment group (screenshot below). I had to use a business rule that checked both the assignment group and updater (updated by). The BR works for both creating and updating, since when an incident is created, the "updated by" equals "created by" in my testing. This solves half of my problem and hopefully helps others. I will keep trying and will add additional info if I can get the remainder working.