From my understanding I think you have the right idea.
Your Closed Topics will need to have your current membership in groups with them being only visible to those groups.
For your Publically view Category you have a few options.
If you want folks to be able to Discuss things you can use a closed Topic or setup 2 Categories.
Parent Category
Security Setting:
- Everyone: See
- Group Name: Create/See/Reply
Subcategory
Security Setting:
- Everyone: Create/See/Reply
I believe you can make the user list not viewable.