As a first step, simply granting the ability to disable connectors altogether seems the most logical approach. More granular permissions could come later. The binary business-data-not-business-data-but-everything-is-still-enabled approach is not really very helpful from a security perspective.
This functionality already exists, but you have to create the new Office 365 Group from within the SharePoint site to which you want the new group associated. This is done by clicking the gear icon within the site and selecting Connect to a new Office 365 Group.
There is a separate issue specifically for connecting an existing O365 Group to an existing SP site: https://office365.uservoice.com/forums/286611-office-365-groups/suggestions/35079844-connecting-existing-sharepoint-team-sites-to-exist
There is also a separate issue for merging two O365 Groups: https://office365.uservoice.com/forums/286611-office-365-groups/suggestions/19564996-merge-the-two-office-365-groups
It's possible these separate issues could all be rolled into one feature update, since they are requesting similar, if distinct, functionality.
Just posting to link these two issues. I'm not sure if merging two Groups could also include the ability to merge an existing O365 Group with an existing SharePoint Online site.
This functionality already exists. When you create a new Team, you have the ability to associate it to an existing O365 Group.
We are seeing a need for this as well. Two use cases off the top of my head:
During the early days of experimenting with Teams, people created teams and started using them. Once they realized the value, they wanted to then associate the existing Team with a previously-existing SharePoint site which already contained all of their documents and historical data.
For organizations which have not yet completed their migration from SharePoint on-prem to SharePoint Online, it would be useful to be able to associate a Team (or any O365 Group) with a pre-existing SharePoint site once it gets migrated to SPO.