Deny access to users without mappings from groups.

People without mappings are connected without Drupal role but I would like the connection to be simply refused

I believe that's how it's supposed to work, by design.

If a user would ever get a group mapped, and they try to login again, their role assignment will get updated. There is no harm I think in having a user account being created without roles. Unless you've configured a lot of permissions to the "authenticated" role which is "elevated" over "anonymous".

I would assume it's possible to build a event subscriber to the login event to check if a user has groups, and then refuse access there. But I have not build that yet for a project. But maybe it's something you can look into. If it's a setting it could I presume be part of this module.