I think you're on the right track. If you're using the ACL system, you really do need one user group for each user and a resource group for each resource, since the permission system only operates on groups of users and groups of resources at present.
You can write a plugin that will create the user group and the resource group (both based on the user's username) when the user is created, which will make it a little more convenient.
There's an example in my book that explains how to create a tree_root_id user setting to restrict users to individual pages (or groups of pages under the same parent). The downside, though is that extras like Wayfinder and getResources won't respect your settings and will show all resources to all users (though they won't be able to actually go to the resource pages).
---------------------------------------------------------------------------------------------------------------
PLEASE, PLEASE specify the version of MODX you are using . . . PLEASE!
MODX info for everyone:
http://bobsguides.com/modx.html