Lock/Manage Subscriptions/Repos of a group of Hosts

Problem:
I am looking for an approach to manage subscriptions and repository sets for a group of hosts.
More specific: The same thing actually a activation key does, but not only at the time of activation.

Expected outcome:
A group of hosts has fixed subscriptions and repository set, so every host gets the same stuff and you are only allowed to change subscriptions/repository sets of all hosts in that group.

Foreman and Proxy versions:
1.23.2
Foreman and Proxy plugin versions:

Distribution and version:

Other relevant data:
Example: Every host that belongs together ( ~ a group of tomcat hosts) gets activated with an specific activation key. Now everything is good as long as someone likes to add a subscription/change repository set to all of these hosts with a bulk action and is missing a few hosts. Yes you can do that with host collections OK. But lets say someone does testing and changes one or two hosts and well humans are humans -> you get misconfiguration of that group. Also if you forget to change the activation key and add another host… So is there a way to lock them to a specific config? Also if you add a new host to that group this new host is also configured with the same config?

cheers