auth.add_group() actually does a database insert, so you don't want to keep repeating it on every request (actually, I would probably move that code out of the app altogether, as it really only needs to be run once ever).
Specifying the after update callback, on the other hand, does not affect the database at all -- it simply tells the DAL what to do after a database update. In fact, you need this to run on every request because it is part of the model definition (for the same reason you need to run the associated db.define_table() on every request).
Anthony