An IAM user is an identity in the account. A group collects users so you can assign a common permission set without editing every person separately. A group isn't a sign-in identity, and it can't be the principal that assumes a role. Creating a user doesn't automatically grant useful permissions.
Use names that describe the intended person or test identity, then attach only the permissions that the work needs. Workforce access commonly uses federation and temporary credentials; these user exercises teach the underlying IAM objects rather than recommending a permanent user for every employee. The edge case is membership: giving a group a familiar name doesn't put a user in it. Verify the membership itself.