Hi misiu,
Thanks for the advice for the documentation issue. 
Yes, thats correct.
Depends on your usecase.
Simple authentication (username,password) will be called once and for updates you need to reconnect, the CONNECT performance will decrease but on the other hand the PUBLISH / SUBSCRIBE performance would increase if everything will be done in authentication.
Let’s say if your clients do not need live updates for the permissions and they publish/subscribe very often compared to connect/disconnect than authentication would be a good way.
You can use a ClientInitializer to add any kind of Interceptor like: Interceptors :: HiveMQ Documentation
the code looks totally fine. This should work.
Do you have any other extension activated that has a SubscriptionAuthorizer?
This could cause that the other one will never be called.
Kind regards,
Flo