Users only from specific scope of groups with parents

[CMBCKSRL]

Greetings
I have my useres created in FreeIpa like this

ldapsearch -x  -LLL -b "uid=my_user,cn=users,cn=accounts,dc=ipa,dc=com" uid memberOf
dn: uid=my_user,cn=users,cn=accounts,dc=ipa,dc=com
uid: my_user
memberOf: cn=ipausers,cn=groups,cn=accounts,dc=ipa,dc=com
memberOf: cn=grafana,cn=groups,cn=accounts,dc=ipa,dc=com
memberOf: cn=admin,cn=groups,cn=accounts,dc=ipa,dc=com
memberOf: cn=superadmin,cn=groups,cn=accounts,dc=ipa,dc=com
memberOf: ipaUniqueID=4fef55f4-6cbf-11ee-8251-aa18eee04fdc,cn=hbac,dc=ipa,dc=com
memberOf: ipaUniqueID=796c9342-6cbf-11ee-af32-aa18eee04fdc,cn=sudorules,cn=sudo,dc=ipa,dc=com
memberOf: cn=devops,cn=groups,cn=accounts,dc=ipa,dc=com
memberOf: cn=dba,cn=groups,cn=accounts,dc=ipa,dc=com
memberOf: ipaUniqueID=18e063d4-ff7e-11ef-a95f-061d8c3c133e,cn=hbac,dc=ipa,dc=com
memberOf: ipaUniqueID=963b6108-ff7e-11ef-84bc-061d8c3c133e,cn=sudorules,cn=sudo,dc=ipa,dc=com
memberOf: ipaUniqueID=ac6b3218-e477-11ef-8601-061d8c3c133e,cn=hbac,dc=ipa,dc=com
memberOf: ipaUniqueID=f1665388-e47d-11ef-9a17-061d8c3c133e,cn=sudorules,cn=sudo,dc=ipa,dc=com

I want to create users from cn=users,cn=accounts,dc=ipa,dc=com, roles from cn=groups,cn=accounts,dc=ipa,dc=com and keep these users as children of roles from groups.

I tried to use the following config

sync_map:
- ldapsearch:
    base: uid=my_user,cn=users,cn=accounts,dc=ipa,dc=com
    joins:
      memberOf:
        filter: "objectClass=posixgroup"
  roles:
    - name: "{uid}"
      options: LOGIN
      parent: "{memberOf.cn}"

But some unwanted roles are also created. For example, sudorules from memberOf: ipaUniqueID=f1665388-e47d-11ef-9a17-061d8c3c133e,cn=sudorules,cn=sudo,dc=ipa,dc=com.

Is there any way to filter out unwanted groups or maybe create users with their parents in another way?