Both are valid cases. When you assign the roles to the assignment group, it consolidates the number of points to manage user membership. I've also seen single groups dedicated to a given role; for example an ITIL group that you would add all the technicians to. Then for your smaller assignment groups such as software, hardware, etc. these do not grant any roles.
Just make sure you remember to use reference qualifiers to restrict assignment group references to exclude any of these new 'security' groups you would make. The group type works great for this.
Finally, many users decision is driven off their AD which they are syncing group memberships from. Most likely AD has a 'software' group, 'hardware' group, etc. but may not have a 'ITIL' group. Although you can just set conditions for proper OU queries, it's another consideration point for managing membership.
