1 & 3: URestrict did do all of this, but has broken and is no longer under development. I, though, plan on taking up a project similar to this.
2: You have to set who the group can target. "ulx setgroupcantarget superadmin "^,!%superadmin"" (I believe) This will set it so that SuperAdmins cannot target anyone who is above/equal to their rank in the inherit line/tree/w.e. the word may be.