Roles and permissions

everyone inside the foo group role has been automatically enrolled into every course

That's because you assigned them to the role in the system context (Site administration -> Users -> Permissions -> Assign global roles). Go back and remove the global role assignment, then reassign them to the role within a specific course (course -> Administration -> Assign roles). Then they will only enrolled in that course.