It sounds like you are on the right track by creating groups, and restricting access based on those groups.
Unfortunately you can't have per-item permissions in WSS without a custom solution. However, you could grant/remove access to the groups to another sub-site, or a document library/list in...