Adding AD members to local linux groups?

I'm using sssd & realmd to connect some CentOS machines to an Active Directory domain, and it works great for the most part. However, if I have a local user on the CentOS machine (for example, tomcat) I haven't worked out a good way to add the AD users (or an AD group) to the local "tomcat" group.

Is there a best way to do this? It's not always tomcat, we also use our own user/groups for certain home grown applications, and we're used to just creating the user manually; maybe it's better to define common users like this in AD?

Thanks for any advice!