Can Microsoft Graph auto-grant Sites.Selected access on the site created when provisioning an M365 Group?

We provision Microsoft 365 Groups programmatically via Microsoft Graph as part of a legal matter management system.

Our app registration is scoped with Sites.Selected only (not tenant-wide Sites.ReadWrite.All), following least-privilege guidance.

When we create a new M365 Group via POST /groups, Microsoft Graph/SharePoint automatically provisions a backing SharePoint site for that group. However, that new site is not automatically added to our app's Sites.Selected access list, so any subsequent Graph calls against that site (e.g. drive/list operations) fail with accessDenied, even though our app was the one that triggered the group/site creation.

Questions:

1. Is there a supported way to have the site automatically included in the creating app's Sites.Selected grants at group/site creation time (e.g. an option on the group creation call, or an implicit grant because the app created the group)?
2. If not, is granting site permissions via POST /sites/{site-id}/permissions immediately after group creation the recommended pattern, or is there a better-supported approach for this "app creates a group and immediately needs write access to its site" scenario?
3. Is there a race condition to be aware of between M365 Group creation and the backing SharePoint site becoming available/addressable for a permissions grant?

Any guidance on the intended pattern for apps using Sites.Selected that also need to provision groups/sites would be appreciated.