I tried this at my end. It seems currently  to add any groups from accounts from workspace the SPN requires account admin permissions. If you don't want to provide a common SPN that is running terraform code as  account admin. I would rather isolate my code in two pipelines. One creating a Super Admin SPN that is account admin and using that SPN to add account groups to workspaces. Another SPN having as workspace admin and performing workspace related tasks like creating catalogs, cluster and assigning permissions.