Redmine

You can already define for each Role whether issues should be assignable to users with that role in a project. Only users who have at least one role giving them this permission can be assigned on issues in the respective project.

Using this (and possible additional roles, depending on the complexity of your desired rules), you may already be able to solve points 1 and 3 of your requirements. By assigning the groups one of those roles, you could also solve point 2.

Note that you could define a role which does not grant any explicit permissions but JUST the ability to have issues assigned to users of that role. You can then selectively assign this role to users / groups in the project which should be assignable to issues. You can also mix and match this at will with other roles.