Does that make sense? and is it the best approach?
Well given you don't want to use CBSubs it's going to be a bit more complicated. GJ doesn't grant access to all of Kunena. It only grants access to the individual Groups forums. If using CBSubs however this would be quite simple and wouldn't need GJ as you could simply protect Kunena component or individual Kunena categories via By URL Part protection. Please see the below page for what GJ can provide as well as a demo link.
www.joomlapolis.com/cb-solutions/groupjive