You'll only get the option when the OS used is Windows 2008, if you're still unlucky enough to be using Windows 2003 you'll have to use domain groups.
The difference between them is that the domain groups option uses just that, a set of domain based groups that you add the service account to. Problem is you can also add other accounts to which isnt very secure.
The SIDs option does not use groups but a special server login that is disjointed directly from the service account to provide better security.
-----------------------------------------------------------------------------------------------------------
"Ya can't make an omelette without breaking just a few eggs" 😉