By assigning Contributor access to the group, all 150 users will be able to add and edit files in the shared drive. Assigning Content Manager access to the single user ensures that only that person has the ability to move, delete, and share content within the shared drive. This approach efficiently meets the requirement of limiting certain administrative privileges while allowing the group to collaborate on content.

Access Admin Console: Log into your Google Workspace Admin Console.
Navigate to Reports: Go to the Reports section in the Admin Console.
Token Audit Log: Within the Reports, access the "Token Audit" log. This log provides details on OAuth tokens issued to applications by your users.
Review Applications: Review the list of applications that have been granted access to your Google Workspace data. This will include information about the scopes (types of data) that each application can access.
Compile List: Compile a list of all the applications from the token audit log. Include details about the data they have access to and the number of users using each application.
Export Data: You can export this data to a spreadsheet for further analysis and reporting to your chief compliance officer.
Reference
Google Support: Token audit log

Navigate to Groups: Go to the Google Admin console and navigate to 'Groups'.
Create a Security Group: Create a new group and set it as a security group.
Assign Permissions: Set the appropriate permissions and policies that restrict access to only authorized employees.
Manage Membership: Ensure that only administrators can manage the group membership, adhering to the principle of least privilege.
Apply Policies: Apply access policies to the security group, ensuring that the confidential content is accessible only to authorized members.
Reference
Create and manage security groups
Google Groups for Business

https://support.google.com/a/answer/3540538?hl=en

Send from Group Email:
To send emails on behalf of a group, users must add the group's email address to their Gmail account and verify access.
This allows them to select the group email as the sender when composing or replying to messages.
Steps to Add Group Email:
The user should go to their Gmail settings by clicking the gear icon and selecting "See all settings".
Navigate to the "Accounts and Import" tab.
Under "Send mail as," click "Add another email address".
Enter the group email address ([email protected]) and follow the verification process, which may involve receiving and entering a confirmation code.
Once verified, the user can select the group email address from the "From" dropdown menu when composing or replying to messages.
Reference
Google Workspace Admin Help: Send Emails from a Group Alias