how to create resource groups in F5 APM

It's important to understand that APM is not specifically analogous to FirePass. They share a lot of functionality, and indeed a lot of the code base, but they aren't the same. To that end, APM doesn't natively support the same resources inside resource group methods as FirePass. The local user database in 11.4 gets close, but is still not quite "FirePass-ish". You can, however, achieve more or less the same kind of functionality by using the local user database, or any third party LDAP/AD/RADIUS directory service, and then assign resources in the APM visual policy based on membership attributes.