There are files we'd like to expose to an entire department through weblink. Most people in this department do not have a license, some do. 

When I added the department group in the Admin Console, I selected Only allow read-only access:

This was great until I realized it superseded the effective rights of some licensed members of that AD group - they were in a read-only state, could not create, edit, or have fun. 

My next step was to assign the Manage Trustees privilege in the Rights tab for that AD group. This seems to make everyone happy. However, it's Friday afternoon and most everybody has gone now so my sample size is small. 

I'd like to use the department group to give everybody access to these files, keep the few licensed ones empowered, but not somehow grant a license to someone unintentionally. 

Did I accomplish those goals?