Greg,

What is the problem with even 100 groups that you set as visible or not depending upon the user. Sure, it is a lot of XML, but it is a once-off setup, and you rarely touch it thereafter.

I would certainly go that route, don't see any issues with it.