Resource groups

rigouts you have multiple option either you can create a new resources groups that way you can draw some logical boundary between the two VDI pools and also apply security policies or exception if needed as an example , Regular employees accessing set of VDI under one resources groups and maybe a contractors accessing AVD hosted in another resources groups that way you can define the security polcieis accordingly and say if the  contractors project is over you can delete it whole resources groups but this will have a cost implication .

Tagging is always mandatory weather you use one or many resource groups now at which level you will apply you need to decide is it on VDI level or resource group level 

Please "Accept as Answer" if it helped so it can help others in community looking for help on similar topics.