"Maybe" - the problem is that you'll need to run things as a domain admin / similar level of privileges.
I would assume that you can control domain memberships via PowerShell scripts (not tried it, but it'd make sense to me). The problem is that you need to run said powershell script with an account that has the needed privileges & talk to your DC as well.
Bear in mind that most provisioning actions are local to "the machine being provisioned" and things like "joining a domain" are fine, but actually fiddling with domain group memberships tends to require ADUC (Active Directory Users & Computers" and assorted privilege levels.
So - "can it be done" - I would say probably yes (via Powershell script for instance - one direction for you to investigate into). But there's a few "be careful what you ask for" clauses to be mindful about.