Questions about group member management

Hi, I have a single Discourse instance with some public facing forums which are visible to anyone but contributors have to sign in to post. I also have some private forums access for which is controlled using groups. I wanted to check is 1,2 or 3 correct? (or none of them!):

  1. Only admins can invite additional members to the group
  2. Admins and a group specific moderator can invite additional members to the group
  3. Any member of the group can invite others to the group.
    Then to remove members from the group (I would set it so members can leave the group themselves) would it be admins or admins and moderator that could remove members?
    Also that removing members from the private forum/group does not remove them from the publice facing one.
    Also could 2FA be enforced for members of this private forum/group?
    Thanks alot