Which user/group owns the CVS repository (e.g. the /cvs directory)?

It sounds like you might be able to solve your problem by changing the
group ownership of the CVS repository, and all subdirectories, to
'cvsgroup'.  Then, set the GID bit on these directories so that newly
created files in those subdirectories will be owned by the same group.
Example:

# chown -R .cvsgroup /cvs
# chmod -R g+s /cvs

It should then be possible to use group permissions to control access to
files within the CVS repository.

-- 
Joel Schneider               Yan Xin Qigong in Minneapolis
joel at joelschneider.net       http://yanxinqigong.minneapolis.mn.us/