You will also want to consider setting up a unique role for this group to limit their functionality, regardless of workspace, unless you are expecting them to be a fully functional contributor. Personally, I'd give them build rights but not send - one misfire can be a credibility hit.