How can I edit the NTFS permissions for a Security Group?

There are a couple of ways you can handle this. One approach is to disable inheritance for that folder and use the option to copy the permissions when you do that. This means the folder won’t depend on the parent folders for its permissions anymore. This way, you can remove the Security Group at that level and adjust their permissions accordingly.

Another method is to add a 'deny' permission specifically on the subfolder for that group, but be cautious with that as 'deny' permissions can complicate things if not managed carefully.

Totally agree with the previous point! You'd want to use 'deny' permissions sparingly because they can lead to confusion later on. It can be pretty common to disable inheritance a layer or two down for share structures but just make sure it doesn’t go too deep.

Also, just to confirm your point about preserving permissions: yes, if you disable inheritance and choose 'Convert inherited permissions into explicit permissions' in the Advanced Security Settings, you can then edit the permissions for that Security Group and just remove 'Write' without affecting anything else. You're on the right track!