I recommend that classic confinement is where you should be putting your efforts, rather than trying to work within the strict confinement limits. As I said above as a backup solution, your need for users and groups, and other system-level access your snap is a prime candidate for requiring classic confinement. The documentation about the process is here:
