In general, that is not a practical directory structure for reasons you are encountering. If you only have one website, then the /var/www dirctory might be just fine. However, in my experience, 20+ years, the best approach is to create a separate home partition so that the home partition can be mounted nosuid, noexec, nodev, et al. Each website has its own system user account. That account is given a shell, rssh, which allows sftp but no ssh. This is practical when hosting, when hiring developers, or even from a security point of view.
Having written that much, one solution becomes clear: move the sites to user account directories and update the web server configuration. This can be done safely by creating a copy of the website on a subdomain. For example, for the domain, www.website.com, create a CNAME called test.website.com. Make sure the site on test.website.com is working. Then, update the web server config file to point www.website.com to the new location once you know it is flawless.
At that point, you can provide access via sFTP to whomever you please without this concern.
But... to get to the point and answer the question: a less obvious but effective solution is to use ACL. With ACL, you can get much better fine-grain controls on file system permissions. Using ACL can provide the desired restrictions.
The first thing to do is to install the acl software:
sudo apt-get install acl
The next thing to do is to mount or remount the filesystem with the ACL option.
sudo -e /etc/fstab
You might see a line like this, so add the acl option.
UUID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx / ext4 defaults,acl 0 1
Save and quit. Remount with acl enabled.
sudo mount -o remount,acl /
After this, you will have access to ACL. There is guide for ACL on help.ubuntu.com.
Some examples of ACL usage on askubuntu.com:
Managing arbitrary user permissions under PureFTPd
Whats the simplest way to edit and add files to "/var/www"?