Are you delegating authentication? When you do, users are created on first login. And if you choose to enable group mapping, that will happen automatically too. (Docs)
If you want to provision users before the fist login, you’ll probably want to do that using the Web APIs.
The best way to master the API is to perform the desired action via the UI and eavesdrop to see which calls the UI made to accomplish the action.