You need to find the "Uploaded Files" which located in "For this block" (media tab) of File Upload element. Then add the group access right for it programmatically. Below the code demo how to set accessright for the folder:

var securable = folder as IContentSecurable;
var descriptor = securable.GetContentSecurityDescriptor();
var acl = new ContentAccessControlList();
foreach (var entry in descriptor.Entries)
{
    if (!entry.Name.Equals(EveryoneRole.RoleName, StringComparison.InvariantCultureIgnoreCase))
    {
        acl.Add(entry);
    }
}

// add accessright for the group here
...

_contentSecurityRepository.Service.Save(folder.ContentLink, acl, SecuritySaveType.Replace);

Thank you for your reply Dac, however this doesn't seem like a scalable solution to me, as it doesn't allow administrators to set permissions themselves. If these permissions need to change or more granular permissions are needed, I have to go through the whole build/deploy process every time.

Fortunately your reply got me on the right track in understanding how file upload permissions are applied, and I'm posting the solution here in case others run into this.

It seems that Access Rights are applied to file uploads at the point in which the "File upload" form element is added to the form, and whatever global Access Rights are applied to the form at the time of creation, those are the rights that the file uploads inherit for the life of that form element. After that point, changes to Access Rights have no effect on the Access Rights of the uploaded content of that form element.

If Access Rights changes are needed, then the Access Rights need to be configured beforehand, and the "File Upload" form element needs to be deleted, and recreated. Bear in mind that any previous file uploads will be lost when the form element is removed! So be sure to download any data that you need before making these adjustments. Once the "File Upload" form element is recreated, current Access Rights are applied, and all future file uploads receive the same permissions.

While this approach is far from convenient, it at least gives administrators/content managers the ability to manage these permissions without waiting for a developer to build/deploy their site.

Hope this helps someone else!