I like the /var/www/example.com convention.
I like to have the conf in /etc/httpd/vhosts.d/example.com.conf and included in the main apache conf. I don't let the customer edit this. This way if you add a new domain and the configtest, reload or restart detects an error then it's really easy to back out.
I use posix acls to add default acls on the above dirs, so that any files they create are created with rwx for their server user(the one used in suexec)/group, so that no matter what user they are when they create the file, the user the webserver can access them and so that members of the VritualHosts user's group can access all of the files.
I use private as the place for password and group files to go.
If I want to allow the site owner to make config changes I also create a file such as:
which is included in the VirtualHost in the main config for the domain i.e. /etc/httpd/vhosts.d/example.com.conf.
You need to be careful with this though as it means the user can break your entire config so you want to be pretty careful the user knows what they are doing.
I tend to do it when there is a server with multiple VirtualHosts all owned by the same customer, so if the break the config, they only break their own sites.
I'd also suggest using suexec which allows processes to run as a user other than apache and also allows dynamic content to be run as users other than the apache user.
You may also want to look at the various RLmit directives, which allow you to lmit resource usage on a VirtualHost, etc basis. See: