Thank you Tilmann, I will try that and report back whether I managed to get it working.
But right now, I'm attempting to experiment with subsites. My steps:
- mount subsite while logged in as site-wide admin
- log out
- go to /subsite/register and create a new user
- I got redirected to /pvt/home.tcl, which seems wrong; I should have gone to /subsite/pvt/home.tcl, which does exist
- However, it does appear to have worked, in that my user registered via the subsite cannot see anything outside of the subsite. In fact, I can't even go back to /pvt/home.tcl without being asked to register - not sure how I got there the first time! So this will work, I think, but I will look into using pure groups anyway, just because I need to know how to do it both ways. But that's a subject for a different post...