Permissions, ACL and Groups
Permissions control is not related to Civi groups. It is controlled by WordPress user roles as you suggest for #1 fix. You should have no trouble from a security management stand point to set it up so staff cannot assign themselves to other roles.

You might want to add this plugin for better control. https://www.role-editor.com/