The entries in "cn=staged users" container can't be added to the user group before activation. This makes the ability of adding user by external system only half-done.
External system can fill information about user to IPA but admin still need to manually add groups membership after user activation.

Thierry noted that this thread might contain useful information: https://www.redhat.com/archives/freeipa-devel/2014-June/msg00100.html