Well, it's more than anyone needs to know, but my searching has raised a few more questions.
Group membership is not enough to create a modified check_smtpd_rules file, since the ruleset seems to be based on username level checking.
Additonally, the ruleset needs to account for pseudonyms, and add/remove them correctly as well.
This means that the correct action to make the entries would compile a list of the "restricted" users and their psudonyms, and then pass that to set the account's value, followed by a console-save.
Ideally, the same compiled list is used to set both values.