Here's a quick sketch. I'm imagining that content would be 1. public, no group, 2. posted publicly to a group (whether someone is allowed to do so depends on the client's implementation of group moderation), or 3. posted privately to a group. Public notes (whether posted to a group or not) could be cross-posted to a group. If cross-posted, it would show an indication of from where and by whom. Private notes would be visible only by group members (protected either by relay or encryption). Notes from groups you're a member of — or following as a non-member — would show up in your main feed with an indicator of where it was posted.

This gives the publisher/group owner/group members the ability to control 1. the context/audience (group) of a given note and 2. who sees it independently.