groupadd www-devs
setfacl -R -d -m g:www-devs:rwX -m g:www:r-X /www-data
setfacl -R -m g:www-devs:rwX -m g:www:r-X /www-data

$ getfacl --all-effective /www-data
getfacl: Removing leading '/' from absolute path names
# file: www-data
# owner: apache
# group: www
user::r-x
group::r-x          #effective:r-x
group:www:r-x           #effective:r-x
group:www-devs:rwx      #effective:rwx
mask::rwx
other::---
default:user::rwx
default:group::rwx      #effective:rwx
default:group:www:r-x       #effective:r-x
default:group:www-devs:rwx  #effective:rwx
default:mask::rwx
default:other::rwx

$ touch /www-data/foo
$ getfacl --all-effective /www-data/foo
getfacl: Removing leading '/' from absolute path names
# file: www-data/foo
# owner: root
# group: root
user::rw-
group::rwx          #effective:rw-
group:www:r-x           #effective:r--
group:www-devs:rwx      #effective:rw-
mask::rw-
other::rw-