Is it at all possible to configure the spawn-on-join enforcement to be based on a specific group only rather than on everyone? I'd only like my guest group to be forced to spawn when they connect / relog, but I do not see an option to define a group or a permission node to force only that group to spawn.

A convenient solution has been introduced in 27ab90a. You can grab the feature from build 439 on the CI server.