Parent group is restricted. Subgroup is not -- no boxes checked under Spam Control.
Owner of parent group can add them to any subgroup. They get a notice telling how to opt-out. Excellent.
However, if member of parent group applies to join a subgroup, they get an email requiring them to confirm.
For us, this obviates most of the value of subgroups.
(Or am I doing something wrong in the settings?)