Hi @Thomas_Quenolle! Welcome to the community. 
Just to confirm, you're running a self-hosted instance on version 3.52, right?
I did some testing earlier today, as I previously wasn't very familiar with the role mapping that happens when generating an authenticated embed URL, and can confidently say that Retool does not touch the existing permission groups for a user that it recognizes either via externalIdentifier or userInfo.
The one thing I did notice is that it's possible to overwrite certain user data if there is ever a mismatch between the externalIdentifier and userInfo that gets passed in. As long as you are careful, this shouldn't be an issue and I think you can move forward safely!