Write to repository on bundle install

I have a bundle that references a few groups. I'm familiar with how to create these groups programmatically with the usermanager, but I'm unsure when to do this.

Ideally, I would like to just run a script once on a bundle install that would check for the existence of the groups, and create them if they can't be found. Is it best to use a component with Immediate=true (and then shut that component down somehow?) or should tap into the bundle lifecyle using a bundle listener? Or is there a best practice that I'm not aware of?

FWIW, I'm using the AEM maven archetype V10