What’s your recommendation on handling roles across multiple applications within a Tenant?
- 
Would you recommend using Groups for that?
 - 
Groups would be a good solution. The group just allows you to assign the roles to the group instead of the user - and then the group membership allows you to inherit those roles (assuming the user is registered for the application whose roles belong to the group).