I would verify that you have "Provision at end of request" configured for Global setting as well as specific-system connector (if this is also configured). The specific system may have "Provision at end of Path" configured, which would override the global setting. I agree that the request should not provision if there is an error and a re-route to escape path. Although, maybe this is a bug.
How are you setting the User Group within the request? It should be set within the System Details tab of the request.