This is more to do with tomcat and os specific permissions than with Bloomreach Experience Manager. It is common practice to set up a user to run your web container (also other services). These need access to the locations that container is running. So if you install tomcat in /usr/local/ then it may need to write in those folders for eg logs (but you can configure that to write in a different location).
The solution you chose sounds fine, just make sure the permissions aren’t too broad.