The groups are a bit confusing in how this works. I understand what you are working towards but it seems to me that a group, in and of itself, shouldn't be in the feed unless you are member of it but you can go to a public group and post or read it and that making it "private" should mean you can't read it unless you join.
The reason I don't like the default behavior is that if you want to have an open community where people can create groups then whatever they want to create is broadcast to everyone, offensive or not and if you say each group has to have admin approval then it's another admin chore that has to constantly be done.
As a result of how groups work I have had to write a script that runs every few minutes to change the "approval" field of every group to 1 so that everything is invite only - this means that someone has to approve every single user that wants to join that group and it seems a lot of extra administrative time for no reason.