Not sure I fully understand the impact of DSEditGroup as you suggest. I don't have a group named 'STAFF'. What I do have is a Windows Domain; and I need to either add an Active Directory/Domain group the the LPAdmins; or permit the local OSX 'Everyone' or 'Users' membership to LPAdmins.
From:
http://krypted.com/mac-os-x/more-group-management-with-dseditgroup/
Im not in love with how you edit memberships, but here goes:
dseditgroup -o edit -n /Local/Default -a cedge -t user ladmins
In the above command we defined the node we were editing with the -n followed by the user we were adding to the group with the -a and then the -t for the type of object were adding into the group, which is listed last. The reason that you have to put the -t with user in there is because we could just as easily have said:
dseditgroup -o edit -n /Local/Default -a staff -t group ladmins
Which would have put a group called staff into the ladmins group (noted by the NestedGroups attribute).
To verify membership, use the checkmember verb (insert witty Beavis and Butthead remark here

. If sud the following command is likely to report back with the fact that no, root has not been added to the group; otherwise it will look at your currently logged in account:
dseditgroup -o checkmember ladmins
But you can check and see whether my account is a member of your ladmins group with the -m parameter on the command:
dseditgroup -o checkmember -m cedge ladmins
Now finally, since no one likes a messy Marvin, to delete our test group:
dseditgroup -o delete -n /LDAPv3/ldap.company.com -u myusername -Pmypassword extragroupdseditgroup -o delete -n /Local/Default ladmins2