UPDATE
I think I got most -- if not all -- of this figured out. I learned about NodeBB in the process -- very impressed with it!
For posterity, take a look at the nodebb-plugin-groupthink plugin. The way I ended up solving this is rethinking the privilege setup from what I first did. Nobody has any privileges to a group's category except group members. If a user visits a group page at /groups/:groupname
the group metadata is still passed to the client so the user can join the group, but the category is not retrieved. Due to some strange bug in the Persona theme (or in templates.js-- not sure) I couldn't wrap <!-- IMPORT partials/topics_list.tpl -->
in <!-- IF group.isMember -->
, but I solved this by rearranging some of the template html.
The plugin seems to be working well. Users can now "Post to a group" similar to how they would on other social networks.