How do I prevent a user from adding contacts to ACL groups?
With situations like that I simply just disable the group. The ACL still works, but users don't have access to add anyone to the group.

If you need to add someone else to the group, just enable, add and disable again.

Heather.