Honestly, I’m having a hard time thinking of a real use-case where group owners shouldn’t be allowed to do all the things by virtue of them being group owners.
In which case you could maybe ignore that problem and grant group owners god-rights. The rest of the permissions then being delegated to individual groups.