I just tested this on 8.7.24: When creating a new "IP-Authentication configuration" record, it is only possible to select FE-Users, not groups. When you type some text, the drop-down list only shows FE users, even if matching FE groups exist.
The documentation does make it sound like FE groups could be selected:
Select the user or the group from the list that should be authenticated when the IP matches
