Thank you user204088 - a question about permissions which describes a security model! (most people just moan they can't get stuff to work, and accept the answer that says change the permissions to 0777).
One thing you didn't mention is how the sites get created, and how they get modified, and how much isolation there should be between sites.
A couple of things of note:
1) I would recommend setting the document root to be a folder below the home folder. That way you can have scope for a per-site include directory, a per-site uploads directory and a per-site session data directory none of which are served up as URLs by the webserver. It also means that all the junk from /etc/skel isn't accessible either.
2) Except in very rare circumstances, your webserver should not have write access to any content within the documentroot.
In order to create users (with home directories) you need to be root - hence I'd go with setting up a template site in /etc/skel and writing a simple bash script to create a user and add a vhost record to the httpd.conf (on my PCLinux box this goes in /etc/httpd/conf/vhosts.d - name the file the same as the hostname, less the www. prefix
Allowing the sites account read/write access to all the sites content is where it gets messy. You could set up a common group and ensure that all files/directories are group writable (chmod g+S) but this means that users can access each other's content. It's probably a better idea to go with the one group per user model, set the file permissions as writeable by the group and add the 'sites' account to each of the single-user groups.
Apache gets read access to the files/directories via the 'other' - so remember to set the umask appropriately.
Bundling this all up into a bash script runnable only by root is simple. You can do stuff like invoke this via sudo (make sure you add further authentication) from your webserver to put a simple front end on the creation of accounts/vhosts.
And once the user account is created you can manipulate the files using the 'sites' account.