Probably the best way would be to not to have GroupD at all. You can add users manually to any user’s roster. Click on a User and choose Roster. Though this won’t prevent them to talk to other users. This is still possible to find other users with a Search or just send a plain message if you know a JID of other user. If you want to block such unauthorised messaging, you can think about using Packet Filter or Raptor plugins.
Easy way is with sharing, but you can only share groups. So, the other way maybe is to do direct SQL inserts into a database (if it’s not embedded one). But that’s maybe not qualifying as an easy method.
I did never use http://www.igniterealtime.org/projects/openfire/plugins/packetfilter/readme.html but it may help you a lot. It should allow you to keep GroupD and block all traffic or only messages form GroupD to GroupD (I need to have it so GroupD can’t talk to eachother,) and allow then specific traffic between users in GroupD and individual JIDs (which are in A and B).