Staff who can access user info including emails

Then it is someone, who is an admin. And that is really bad way, unless that someone is actual admin. Or at least a moderator.

So, no just building an extra group. Out of the box anyway. Perhaps you can code a plugin that changes how security of Discourse is builded.