Application groups are predefined in an application by the application admin.
Whenever a collaboration is connected to the the application, those groups are then created in a collaboration.
Group membership is provisioned to the application, so an application can take action.
Example
Say an application requires users to member of the group 'Create files' to be authorized to create new files in the application. The application admin then creates the group 'Create files'. When the collaboration is connected, the group 'Create files' is automatically created in the application. The collaboration admin can then add members to the group. When one of those members logs in to the application, the application knows that users should have the 'Create files' permission.
Short name
Groups thus created have their shortname prefixed by the application short name (wordpressdemo) and a hyphen, in this case the group short name becomes wordpressdemo-createfiles, to make sure that group names are unique.
Auto provisioning
Newly created groups are empty. It's up to the collaboration admin to put members into groups.
An application admin can select auto provisioning for a group. This will mean all collaboration members are also member of that group.
The collaboration admin remains in control, however. They can disable auto provisioning for a group and add or remove members to the group.