About the first question, the answer is no. Internal embedded LDAP is the primary user store. You cannot use that as the secondary user store. Also, it is not recommended to use embedded LDAP in production. So it will be good to set up an external LDAP server so you can connect to that using identity server and make it the user store. [1]
About the second question, my suggestion is when creating an SP there is a hybrid role that creates automatically for that service provider. You can assign that role to users that you need to group based on the service provider. [2]
[1]. https://is.docs.wso2.com/en/5.9.0/setup/configuring-secondary-user-stores/
[2]. https://is.docs.wso2.com/en/5.9.0/learn/configuring-roles-and-permissions-for-a-service-provider/