Where should I use transaction "PFCG" role for Fiori Launchpad Catalog and Group, in front-end or back-end server ?

I have the following scenario:

1. I will be creating custom Fiori apps and custom oData services in in the ABAP front-end server.
2. All of my SAP users are defined in the ABAP back-end server.
3. Custom RFC will be developed in Back-end ABAP server.
4. I will create a launchpad catalog of all the custom Fiori apps, and add the catalog to a group.
5. to:

• Assign group and catalog to a role
• Assign users to the role

Where should I use transaction "PFCG" ? in front-end or back-end server ?

if i use "PFCG" in back-end because users is defined in the back-end server will I see my launchpad catalog and group roles that is defined in the front-end server ?

if i use "PFCG" in front-end will i be able to select the users from the back-end and assign them to the role ?