Teams app install flow

Hi,

I'm new to Microsoft apps and working on POC to port our Slack app to teams. I went through multiple examples and docs, but can't narrow down prerequisites for certain installation flows.

My use case:

1. User clicks 'Add to teams' for my app

2. I sign user in with SSO (done)

3. I either show built-in group selector to install app to, or use graph to see what groups person is in to show a pop up where the user can select group

4. I create a separate channel for my app

5. I post initial welcome Hero card with CTO button to that channel and add message extension

My bot has needsChannelSelector: true in the manifest, but in app store (added app to my org) I still see Add button, instead of Add to team. I added resourceSpecific permission for Application layer (TeamMember.Read.Group, Channel.Create.Group) but my graph still can't access /users/${userId}/joinedTeams due to permissions, throwing an error that only User.Read was passed.

I'm most likely lacking some basic understanding of scopes and permissions. Can somebody point me to a good example of a similar flow or an article? Is my flow even possible or I should simplify to not reading groups and creating channels and simply add bot to pre-selected channel? If so, how can I make app installation enforce channel selector?

Thank you!