That expression should, at the very least, return the “Everyone” group, but you may run afoul of groups claim limitations (see this article). If you could be encountering the limit mention there, you should test with an even simpler groups claim that will match against the smallest number of groups possible (for example, ONLY try to match the “Everyone” group to ensure the claim is working).
You can check if the groups scope is even being requested in the /authorize request by reviewing your System Logs on the Okta side and check the full request URI listed for an authorize request to the app in question.