So I've managed to figure this out and the answer is "Permissions"
When originally following the tutorial for the 'Integrate Report Web App' that when you register teh application in the Azure AD to get your 'Client ID' and 'Client Secret' to tick some boxes
So notice that the "Read All Groups" box isn't ticked.
So I've gone back and registered the app this time with all boxes ticked
After updating the 'Client ID' and 'Client Secret' in my code I can now read the list of groups with the endpoint:
https://api.powerbi.com/v1.0/myorg/Groups