A) The interface has a "synch" button that is meant to reset the groups if they get changed at the course level.
R: Sorry if I'm doing something wrong but the "synch" button seems only to reset the groups in the course level; if FN Site Group is enabled, every change in the course level changes the groups in site level. The "synch" button not reset this.
B) Aside from that, I would assume that you'd be able to prevent this via the role permissions, as you mentioned. Did you try the "Manage Groups" capability?
R: No, I'm not able to prevent teacher action with role permissions. As you can see in the attached picture, I tried it without any results. In fact the symbols [(...)] seems to show that something is wrong with all this.
C) The way I partially solved the problem was to allow "FN Site Groups" only when the administrator is using it. After the necessary changes, I disable "FN site groups". In doing so, any change in a group at course level only affects this level. Later, when re-enable the "FN site groups" the administrator can see that his groups are still there and if he wants, he can use the "sync" to restore the groups at course level.