That does sound dangerous! but if it works for you...
So your solution is fine, the extra Collaborators user group is perfectly valid, sitting between registered and administrative users. I just wanted to be sure you didn't have more than you needed.
Did you know that you can set up user groups such that they are children of other user groups, and as such they inherent the permissions of the parent group?
For example Registered users inherit permissions from Anonymous users. Now, in your case I haven't used the "profiles" but it would make sense to me that Collaborators inherit permissions from Registered users, and then you refine the permissions further as needed. Admins are a kind of special case so best to leave them well alone. ;)
I wish I could help you with the copy permissions but I don't understand how it works either, I've never got it to work. I generally use the cascading model described above so that means I don't have to set every single permission for every single group.