Sabo, we tried flags many years ago...though it worked for small setups...the complexity you're asking for would never work, and is why we allow customization of each group now.
If your moderator group inherits admin, and that is how they admin the server, then, as you don't want, your best bet is another group that has bits of both.
I've no idea how pointshop works, so there might be better way.