Using mixed permission inherited + locally

Hi,

we have > 2000 Sites, each of the sites represents a project. It will be 200 sites added and delete yearly. There is  1000 users, all of them with read permission on all projects (also in the future).

The project members have to have write  permission on the project. Project members are:

1. Some  (15) of the 1000 users
2. Some further users (10) - not from those 1000 users

All the users (1. and 2.) are registered in Active Directory.

What would be the right solution ? 

Thanks a lot in advance,

Michel