Going from memory here. Haven't done command line ACL for a few years now. Once the permissions are set correctly by groups - typically don't need much change that would require me to do it via command line.

I don't think CACLS allows it though as I recall, not sure about one of the other utils.