Change the configuration of the relevant groups in the Google Workspace Admin console to prevent external users from being added to the group.

Set an Identity and Access Management (IAM) policy that includes a condition that restricts group membership to user principals that belong to your organization.

Define an Identity and Access Management (IAM) deny policy that denies the assignment of principals that are outside your organization to the groups in scope.

Export the Cloud Identity logs to BigQuery. Configure an alert for external members added to groups. Have the alert trigger a Cloud Function instance that removes the external members from the group.