How did you set up Security Groups and Users

I've been tasked to come up with a security group model. We don't want to keep adding individuals to the database. We have business users running SSRS, developers, DEV, QA and PROD environments.I was thinking of creating 3 groups to startReadONLY --> db_datareader, db_denydatawriterREADWRITE --> db_datareader, db_datawriterADMIN --> sysAdminHowever it would be great to see an example of what others have done or suggestions would be appreciated.ThanksMitch