User can add themselves to any group
As you have noted, the big problem with the ACL group system is the lack of control around adding to groups.  I've used the Group Protect extension previously and it does the job.