Yes, it is as simple as that.
You can’t grant access to a subcategory unless the group also has access to the parent category; this protects against the danger you highlight nicely.
It isn’t that bad - you can still link just fine, but the nice pretty Oneboxes won’t generate.
Unfortunately, out of the box it only integrates with Stripe. Otherwise it would be ideal for you.