2) Use a user group promotion, it'll be the easiest. Here's a snippet from my license validation code:
$userModel = XenForo_Model::create('XenForo_Model_User');
$userModel->removeUserGroupChange($userId, 'xiLicenseValidationValidated'); // remove the record so that if they aren't in the group, they'll be promoted.
$userModel->addUserGroupChange($userId, 'xiLicenseValidationValidated', XenForo_Application::get('options')->xilicensevalidationGroup);
If you are checking it inside of a view, you should just use the xen helper ismemberof. See Brogan's resource, he explains how to use it. As for creating it, you should look into how XenForo_ControllerAdmin_UserGroup::actionSave() uses XenForo_DataWriter_UserGroup.