How to grant permissions (ACL) when working with nested groups?
I've encountered the same problem - and solved it by implementing a multi-site configuration and installing the Multisite Permissioning extension.

This may not be appropriate for your setting, it may create more trouble than it solves, but in our case it was very helpful.