This is the way. At least half of it.

On top of that, you use umask and add a sticky bit, so that everything new will have the right group bit set - no need for a cronjob.