I actually started out with that approach, and you're right, if we want all the other stuff then this is the way to go. But I'd still like to understand how the groups stuff works, or doesn't. And to be honest, never having tried it, I don't know how to restrict users to their subsite anyway! :)
