Question on repository file permissions - part 2

[Fouts Christopher (6452)]

I have a "sample" project in /cvsroot

I have a "cvsadmin" user in group "cvs" to manage the sample project.
cvsadmin is also in group "users". cvsadmin initially created 
/cvsroot/sample/dir1/file1, and changed group ownership to "users".

I have a "user1" in group "users" who wants to read from and commit
to the repository.

How do I set up my rwx permissions so ALL members of group "users"
can checkout/checkin from/to the repository, but ONLY cvsadmin can
"directly" access the repository, that is, through a regular unix
session and not via cvs.

If I do chmod g+rwxs sample, anyone in group "users" can directly
access the repository (i.e., delete files). If I do a g-w, "users" 
can only checkout, but not checkin.

-chris