Break inheritance at REPO folder and clean up any unwanted permissions like domain users. (You can leave Creator Owner as it is)
Only add the fileserver administrator initially to the REPO folder. So only the admin should be able to access REPO and its subfolders G1, G2, G3..
Now add G1 group to...