I do not believe that the first login creates the user account automatically.
The user account should already exist in LDAP. Only users present in LDAP can log in to Windchill.
However, users will not have access to the Windchill UI unless they are assigned to valid profiles or groups.
Automatically adding users to specific groups is generally not recommended. Group assignments should always be handled through an access request process based on the user’s role and responsibilities.