Which domain users may log in to a freshly joined Linux host, and how do you limit it to one AD group?

By default every domain user can log in; realm deny --all followed by realm permit -g "<domain>\GG_CH_IT" turns that into a whitelist for one group.

sudo realm deny --all
sudo realm permit -g "g001.ckteck.com\GG_CH_IT"

After the join, access control is left to the domain, so any valid AD account can open a session on the machine. That is far more than least privilege allows. The two commands set the SSSD access provider: first nobody, then only members of the IT group.

Why whitelist groups instead of blacklisting accounts:

• Safe default: a new AD account has no access until someone grants it. With a blacklist, every new account, including an attacker's, is let in.
• Managed in one place: access follows group membership in AD. Adding someone to GG_CH_IT grants access on every Linux host, and removing them takes it away everywhere.
• Fewer rules: one group rule instead of a growing list of exceptions.

The example grants the rule to a global group for simplicity. Strictly following IGDLA (Identity, Global group, Domain Local group, Access), the right would go to a domain local group that contains the global group.

Go deeper:

• Debian manpage: realm(8) — realm permit and realm deny and how they set SSSD's access rules.