Restricting a specific group to a specific category

You might be over thinking this.

There are several default groups that represent the trust levels, e.g. trust_level_2 which contains all users at trust level 2 and above. Use those where possible as they are managed for you.