After a great deal of trial and error, I've determined that the following setting under the App Registration determines whether "Users and Groups" shows up on the Enterprise App...
Authentication -> Default client type -> "Treat application as a public client"
When that is set to "Yes", "Users and Groups" goes away. When it is set to "No", "Users and Groups" comes back. This is the exact setting that is controlling this behavior in my scenario.
Hope that helps someone else.