Hmmm,
This should "just work"
An application group should be assigned to each subsite. The application group for the Main Subsite should be registered users.
So to create several subsites you should be able to make them all subsites of Main Subsite. All users will be members of the main subsite. This isn't really a problem, you could set that up as an administrative site. You wouldn't advertise the URL as one for people to visit or register.
I don't see any need to create more layers when the existing tools in OpenACS can support this use.
If a package doesn't honor these settings, it should be fixed. I think it is reasonable for packages to refer to their parent subsite instead of assuming Registered Users and Main Subsite.
