Users and Services can have the Door role assigned (and you can think of Passes having it automatically). On its own, however, the Door role doesn't give access to any actual Doors - to make that happen, you'll need to assign at least one Group (or else add some custom Rules to a particular User, but that's another topic).
Your account can have up to 100 Groups representing different access needs - if you're a typical company, group names like "Employees" or "Developers" or "Managers" would be common.
Each group can have up to 20 rules that define what its members are allowed to access - access can be granted to all facilities or just certain campuses/buildings/doors.
Each access rule defines what the group has access to and optionally limits when it has access to the selected facilities by selecting a Schedule.
Example: A group called "Corporate Employees" allows access to the Corporate HQ building from 5am-9pm weekdays and from 10am-2pm on weekends. All users who work in the building but don't need after-hours access are added to this group.
Example: A group called "Delivery Drivers" has access to the Front door of three different buildings from 9am-5pm on weekdays. Then three different Passes (each with its own unique keypad code) are set up called UPS, Fedex, and DHL that all use this group.
Groups can also be associated with Departments - this isn't really important until you restrict a Manager to particular Departments, at which point they're only allowed to add and remove Groups associated with their Departments. But if you don't have any groups associated with their Departments, they won't be able to add any Groups to anyone!
By default, users with the Admin or Manager role can edit Groups, but you can restrict Group management to only Admins in global settings if necessary.