Which certificates to use for group enrollment, how to generate sample certificates and where to implement them I cannot find any clear answers to.
Use the following Certificate Overview to create your test certificates.
As far as I've managed to understand, group enrollment is based on a root- or intermediate certificate to create a device certificate, but how does one achieve this? And must this be done for each device? Is there any way to build a single firmware with a single certificate included and simply provision with a device name generated upon first boot?
See IoT Hub Device Provisioning Service concepts#enrollment
At device side you shouldn't need to change your code to be able to provision using group enrollment. You may need to have the entire certificate chain on your device to successfully provision: Sign Devices into a Certificate Chain of Trust
See also: Controlling device access to the provisioning service with X.509 certificates
I hope this can help you get started. Let me know if you have more questions? Otherwise please mark it as answer :).