Where should be user group membership stored for RBAC when using OAuth to access SPA and REST API

Question

I am working on implementing oauth2 to secure web app that will call REST API as well as give access to other potential clients to access the same rest API. I would like to use