Falko, Till, is there any reason that ISPConfig isn't already configured like this? Perhaps my solution is too simplistic? I would've thought that the default 755 permissions would be very loose for a production virtual hosting environment, no?
There was a reason in some older ISPConfig versions, at thi time the WebFTP was file based and not FTP based. But in the current versions I see no reasons why this wont work except of the problem with backwards compatibility.