In the same section of RFC 7643 that you linked, in the description of the User resource's "Groups" attribute, the following explains why Entra provisioning does not allow attempting to update the "Groups" attribute on the User resource.

Since this attribute has a mutability of "readOnly", group membership changes MUST be applied via the "Group" Resource (Section 4.2). This attribute has a mutability of "readOnly".