Hi, Jim!
I've been working with F_BKPF_BUP and authorization group the way you described in your first option (items 1 and 2) and it works well. Just make sure there are no roles with "8" (asterisk) in the object F_BKPF_BUP and you will be fine.
Note that in OB52 the first period is that is opened for the Auth Group that you entered in OB52 last column. The second period is the one that is opened for everyone else.
I hope that is what you were looking for.