That's a possibility, an instance for every group, each with it's own subnet.
It requires opening up a port for every instance.
Does not
necessarily need client-config-dir.
If need filtering on client level, client-config-dir is needed, not needed on group level.
Another possibility is one instance and then use firewall rules in the FORWARD chain on tun interface using the client-specific tunnel IPs.
This setup requires client-config-dir with static tunnel IPs based on common name of clients certificates.
What suits best administration wise would depend on how many users I would think.
P.S.
--client-to-client should not be used in majority of cases and can possibly be a security risk, there is no easy way to filter traffic and no way to log it.
Packets stay internal to the OpenVPN process, so they are not exposed to the kernel.
There exists a plugin method to filter based on common name but it's very limited, so not a protocol based filter.
