While it is technically possible to have a GroupSpace within a GroupSpace, given the potential complexity of the permission acquisition under such a scenario, and the likely confusion amongst our group users and reviewers, we've decided to block that option completely.  Here's how we did it:

• Log into the ZMI as an administrator, and go to the root of your Plone site.
  
• Click on 'portal_types', then click on GroupSpace.
• Check the 'Filter content types?' checkbox, and then Ctrl-click any items you want your group users to be able to add, excluding GroupSpaces. Make sure you include folder as a selection, assuming you would like to be able to use subfolders.  We've enabled: Document, Event, Favorite, File, Folder, Image, Link, News Item, and Topic. 
• Click 'Save Changes'.
  

These steps can be generalized to prevent adding any particular content type from any other content type.

Note: If you limit the content types that can be added to a container type (also known in the Plone world as a 'folderish object') using this method, and you install or develop additional content types later, remember to return to this page in the ZMI and add those new conten types to the allowed content types list. If you don't, your group users will not be able to add them into a GroupSpace.   

Second Note: If you are logged in as admin or under an account with the manager role, you can also now change this on a per-folder basis within Plone.  Go to a folder, click on 'Add item...' and then click 'Restrict...' at the bottom.  You can keep the site default, or manually override for that specific folder. The ZMI technique described above is useful setting a site-wide policy, while the Plone-based technique is useful for individual exceptions.