File/dir permission conundrum

I support a dev server for WordPress sites. Server is using the Nginx/php-fpm stack. I'm struggling with setting up file and directory permissions so that www-data has read and write access while our developers in the users group can have the same ability to read and write files/directories. How would this be accomplished without killing security best practices.