I keep my units in the same group. They will ignore the update if it is the same version as the unit already has. This also mean that if I move other units into this group later they will also be upgraded.
There are many ways to skin a cat. If you want to keep your groups clean you could do it like this:
Main group (all common settings for all countries applies to all units)
— subgroup for firmware upgrades (if applied to all units at once)
— — sub sub group for Germany (localized settings for language, keyboard and more)
— — sub sub group for France (localized settings for language, keyboard and more)
In this scenario you could first set the firmware upgrade group to upgrade all units to 9.1.3 and wait until all units are in compliance with the upgrade. In the next step you change settings and upgrade all units to 9.3.1 and they will follow.
The other way is as you described to have subgroups for upgrades in each country setting.
Main group (all common settings for all countries applies to all units)
— sub group for Germany (localized settings for language, keyboard and more)
— — sub sub group for firmware upgrade to 9.1.3
— — sub sub group for firmware upgrade to 9.3.1
— sub group for France (localized settings for language, keyboard and more)
— — sub sub group for firmware upgrade to 9.1.3
— — sub sub group for firmware upgrade to 9.3.1