First, create a custom field in the Account to hold an email address.
one Workflow merely prepares the email address so it is ready, in the Accounts record (not in a related record). So, whenever the security group changes, you copy the email address into that new custom field.
the second workflow sends the email whenever any field is changed in the account.
I’m not sure this scheme can work, it’s just an idea I had, you will have to try it.
Your first workflow will have same my issue. It can not auto recognize account’s group then there isn’t action to set custom email equal Group assignee email.