The Plug-in is the secret to expanding the product. The Plug-in architecture exposes selected events and allows the developer to insert their own code.
Between the documentation, the forums, and some poking around I could figure it out. It looks like "user groups" are just fancy types of users and you add user groups just like a user.
Today, I developed an LDAP authentication plugin. It's not full featured and tailored just to my needs, but works nicely.
The forums showed me how to add users and content via the api in MURA.