Yes, there are a few ways of doing this depending on what you're trying to accomplish exactly.
The first method can be done through the samba config. This will only allow these users to connect to Samba, other users can still login through other services (ssh, local term, etc). With this, you'll want to add a line to your [global] section in smb.conf:
valid users = @groupA @groupB
The other method is by modifying PAM rules. Different distributions have slight differences here, but generally speaking there are PAM rules per service as well as common rules, you can decide what is best. You'll want to add an account restriction using the pam_require module. An example on my laptop (Fedora 13) would be to modify the account section in /etc/pam.d/system-auth to:
account required pam_unix.so
account required pam_require.so @groupA @groupB
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account required pam_permit.so
To simplify administration, you might want to create a new group in AD for the purpose of tracking users that can login to this server.