1. Only way to do this is the way you showed, have one user per group and assign a different IP pool for each group.
2. No, currently the PIX will only assign IP addresses to VPN clients out of a local pool.
3. It used to be, I didn't think we even updated it or provided it any more though, I haven't heard anything about EasyACS for at least a year or so now.