The best way is to setup DNN Security Roles that mirror your AD Groups. Then you assign the permissions to the pages based on DNN Security Roles.

Yes they have to be done by hand currently. Look at it this way, and I'll use the college I work at as an example, we have one AD for the whole college which means there are hundreds if not thousands of different AD groups but we run DNN using the AD provider for just our school which has about around 100 groups. If all of the AD groups were automatically pulled into DNN it would be a disaster trying to wade through them to set permissions. Even if all of the groups for just our school were pulled in it would be unwieldy when for the majority of the site only two are required (Staff and Student).

Once the roles are created in DNN and you've got synchronized checked then users should automatically be added to their role when the log in (or be removed from the role if necessary). This is assuming you're using DNN 4.6.0 or above. DNN 4.5.5 and below only synchronizes the first time a user logs in unless you've applied the AD fix. If you are using lower than DNN 4.6.0 let me know what version and I'll point you to the correct place to get the fix.