Clients want what they want. That's fine with me as long as they're willing to pay for it.
Problem is, how will Paypal know the username to add to the group and therefore be able to add it
This is the key question. It's been a while since I looked at the PayPal API, but IIRC, you can send a user ID along with the payment submission and they'll send it back to you with the confirmation.
As for protecting the page with the snippet that receives the confirmation, the PayPal API should take care of that. The page will have to be published, but there will be a way to tell if the information is really coming from PayPal.
Once you know the User ID and have confirmed payment, it's just a matter of doing this:
$user = $modx->getObject('modUser', $userId);
if ($user) {
$user->joinGroup('GroupName');
} else {
// user not found
}