Best Practices to limit application of LogicModules?

Your initial notion of using the resource group in the AppliesTo is what I would recommend as the most scalable way to handle this. With the current module exchange, you can preserve the AppliesTo through module updates and the module would otherwise be as designed and support would be able to assist should issues arise in the future as no functional changes were made, just the appliesTo field. Make sure when you save the edits, you clarify the changes in the notes. 

My recommendation would be to make the AppliesTo of the datasource something like 

hasCategory(<example>) && join(system.groups,",")=~"<examplegroupname>"

so it only applies to the desired devices that reside within the example group and which also receive the correct system.category value. Trying to manage the application of modules at the group level isn't that sustainable as it will respect the current group membership, but new devices could still be added.