Using an internal group that automatically imports users from an AD group

[Yeahdj]

Hi folks, hope you can help. 

I work for an organisation that does all of its licensing/permissions etc based on AD groups.

Currently we have an AD group in JIRA, once users are added to this group on AD, they are synchronised to our Jira Server where the corresponding group gives access to 'JIRA Software' automatically - great! 

Except now we have hundreds of users who have either never logged in, or haven't logged in for a long time. 

So

• We have read access to AD, but not write, and we're never going to get write access.
• We don't have script runner - I have asked, maybe one day, but not right now. 
• I am reasonably proficient at programmatically manipulating JIRA via API/Database

I am going to have to put a second, internal group in front of my AD group that I can read/write from/to - does anyone have a setup like this, and can give me any tips?

Thanks!