Now manage users and granular user-level access to repos... it's doable but you're going to write a boatload of one-off scripts and hacks, which tools like soft-serve have already implemented.

Right, but you could easily end up writing a bunch of custom automation scripts and/or APIs around this, at which point (unless you really like DIYing stuff) you might better off with something like Soft-serve.