Hey Aldert:
I am working on some fixes and a document that explains this in detail so someone could do it without knowing the internal stuff (i.e. just from screens that have labels and values that make sense..hey there's an idea!).
The screens are completely messed up, but the underlying stuff mostly works. You can find out more about the ArsDigita coder's original intent by running something called Group Admin Pages - Acceptance test which can be found at this location on my server: http://<replace-this-with-your-server>/doc/acs-subsite/group-admin-pages-acceptance-test.html
But from reading your posts, I can see that you have been swimming in the back-end, so here are the raw steps that I performed on an unmolested ACS 4.2b system (not OACS!). I am interested to know if these steps work/look the same on OACS.
At this point you will find that group members can access their respective subsite and that the seventh user you created cannot access either subsite. I will document this later in a more understandable way.
Regards..