Here is all the information I gathered (thanks to eileen):
At the moment candidate groups is just a string (i.e. string array) on the task, so it has nothing to do with the user’s roles. But you can query tasks having a certain candidate group (no one-of functionality, each group has to be requested separately). Candidate groups are returned on the task object.
So the answer is both yes and no: roles are replacing the user groups to handle the permissions in Camunda, but those roles can’t be used as candidate groups.
According to another forum post candidate groups are on the roadmap, however it is unclear when it will be released or if it is improved (we already “have” candidate groups, they are just not useful at the moment).