I don't think that a google group can be the owner of an Apps Script file, and therefore you couldn't execute it as the google group.
A Service Account is behaving as it's own user with it’s own account.
I'm assuming that you want users to have some type of access to a file or files in your account?
A Service Account has it’s own Google Drive folder and it has its own email address.
The service account Drive folder can not be seen in Google Drive, it doesn’t have a UI like Google Drive has to see folders and files.
So, working with the service account needs to be done through code.
It is possible to use a service account instead of a Shared Drive (Formerly known as Team Drive) to give access to users in a domain to that Service Account Drive.
Service Accounts can not use all Google API’s. It can’t use YouTube or Blogger.
I did a search about putting an Apps Script file into a Service Account, and there is some information about it.
Search:
Put an Apps Script file into a Service Account
Do you want users of the app to have access to some of your data?
Are you trying to insulate a specific account from any possibility of being hacked? If you want a total separation, it might only be possible if you created a different user account. If you had a paid Workspace account, you could create a new user account just for specific purposes. For example, if you wanted to send a email, and not use an alias, but keep the main email from being known, then create a user account to send the emails. I don't want people to know the email address of the admin account of my Workspace account, so created a different user account to send emails to users.