SharePoint groups source

[CB1]

As a general concept, if you are looking to restrict access to a SharePoint site to a group of named users - are the users/groups which govern access 'SharePoint specific', e.g. created within SharePoint itself, or do they represent broader 365 groups created directly in Azure AD? 

[#2]

This depends, a SharePoint Communication site is not linked to a group and therefore permissions are just on the site. For Modern Team sites, they are linked to Groups so membership of the group reflects SharePoint membership