Principle of least access , always assign access at a minimum level required for the job role. [EDIT] Suggest enhancing the question. The answer assumes there is a documented known and approved level for the job role that would allow for this assignment to be given AND a process for verification it can be assigned. Otherwise , leaves a possibility of social engineering manipulation - even if the impact is low with minimal privilege.

Question says "account is yet to be provisioned" so how could he can be added to group [edit]I modern IAM it's a nonsense to give access if the provisioning process is not yet completed, the correct answer is 'Do not give any access'. Moreover , 'Put the employee to a group that has minimum access required for the role' is another nonsense: if it had a role, then the provisioning process can complete and give exactly the access needed for that role. [edit]