Where should I mount these drives? (/var/storage/ /home/storage/)
I assume that you've already got a drive in the box which is currently providing all the storage (including swap space). Potentially you can triple your I/O throughput as well as your storage capacity.
For the purposes you suggest, then deploying the bulk of the storage on the additional drives as a RAID mirror isn't going to help redundancy - but it does mean that your backup is always up to date (if the only thing you're trying to address via backups is a disk failure) It won't help performance much for this kind of serving. Setting them up as a stripe set will improve performance - but at a big risk of full data loss if a drive fails.
Allocating swap partitions of the same size on BOTH the 2 additional drives will give you the option to tune swapping if that ever becomes an issue (probably makes sense to set the backup drive as the highest priority unless you use it for anything other than backups).
The approach I'd take, if you're explicitly intending the data disk to provide all the storage for your data, is that the (non-backup) filesystem should contain the home dirs for the users, so mounting it on /home is the sensible choice - with additional directories for shared stuff (e.g. by group) along with a directory for the webserver document root. If you've got enough space on the backup drive, then mounting it on /var will distribute the I/O better, improving performance.
What groups should I make?
erm...the right ones for your security policy.