This makes the magical 'confluence-users' group obselete.

It will need to be implemented at the global and space levels

At the global level, there should be a separate permissions set for "all authenticated users" that kicks in for anyone with a valid username and password to log in to Confluence. This way, you could say "anyone who can log in gets USE CONFLUENCE perms, without having a confluence-users group.

At the space level, it would necessarily mean "all users with USE CONFLUENCE permission", as otherwise the user wouldn't be allowed to log in in the first place.

This makes it impossible to deactivate users, so we'll have to reinstate that as an option somehow.