Always try to use the minimum permissions required to do the job, like this you can protect against current and unknown threats. With this in mind, there are three requirements that can be extracted from your explanation:
john needs to be able to read and edit the files
www-data needs to be able to read the files
Other users on the system have no business ...