WordPress – cloud server

I want to install WordPress on my cloud server. So far I have a Debian 6 server running MySQL with all the updates. I didn’t install Apache2.2 or PHP5 yet because this is where I’m stuck.

I plan to run virtual hosts on my server. There are 2 other users (friends) that want to share the same server. Each user will have their home directory as /home/USERNAME/ and their web directory as /home/USERNAME/www/

My question comes down to user and group permissions. Apache will run as myapache. Do I add each user to that group? Or will that become a security issue? When I read other forums, they said to do that and thus allowing you to chmod using 750 or 740 (not giving ‘EVERYONE’ any access at all. However, if a user is a member of the apache group, can’t users within the server peak at files?

How do you guys manage virtual hosts/users?

Also, what other software would you recommend installing on the server. Right now I have rkhunter and clamav.