In the agent config settings, you can select a single OU where no groups are stored.
NOTE: This will then not synch any groups, and will remove any AD groups that have already been synched to Okta. So If you're using any exisiting AD groups previously synched to perform provisioning and deprovisioning, PLEASE BE VERY CAREFULL.
Thats the whole point. It does not look like there is a way to not to "enable" the sync for Groups. The work around is to "sync" with OU which does not have any groups, but if groups are added into the OU by mistake, the agent would sync these groups.