Currently this doesn't exist, but i've thought about adding it a few times already. I'll probably add it into my version of the module and send the changes back to Tam.

I've already modified the Sync Role function, so if Active Directory returns false and DNN returns true for membership of a role, it removes the role from the users DNN membership table.

It wouldn't be too much extra code to create the group if they're a member but it's not configured in DNN yet.