I don't know that I have some definitive answer to your first question. I like having a Primary group and then adding permissions through Secondary groups. That just works best on my site. However, I do have a Primary group I have moved some users into that takes away permissions because you can't do that with a secondary group.