LDAP doesn't track this in the way you need. It can know when users authenticate (check into your hypothetical group), but not when they deauthenticate... it wouldn't know when to remove users from the group.
Now you tagged the queston "Windows", so I'll add that an Active Directory LDAP implemention specifically can tell you this. However, you have to query the DC's event log rather than LDAP, you'll be limited to certain kinds of logins. For example, you can know when users log into and out of domain-joined Windows computers, but not when they close out of a web site using an authentication method tied back to Active Directory, as that session info in only maintained on web servers. You'll also need some fairly complex code to pair up logins/logouts.