Layers of access to security groups and folders

Given the task of configuring security groups, adding folders filled with other folders to each of those groups.

What is a good strategy for organizing this?

After creating the security groups, add the folders assign access and rights to those folders, and then the folders within folders decide who needs what access?