I think best is to create new system statuses, and then hide them for the entire instance, but unlock them.
For the group that needs the status, they can unhide it for that group. For everyone else -- they'll never know that status is available since it's hidden. This will give you the most flexibility over the entire instance.
We've gone the route of only creating the status for the group and that has led to plenty of heartache since other groups decide at different times that they need that status as well -- this has occasionally led to the same status in different groups with different "Keys" -- e.g. "Briefed" represented by BRF in one group and BRE in another group. This makes reporting really difficult