There isnt really any 'best practice' for this, as its unique to the individual site.
Your suggestion on how to set it sounds fine, however only if there is a situation where 'supporter' doesnt have any member permissions. If it's the case that every supporter gets the permissions of the member group, then you might as well set permissions on the supporter group