Don't know about the API, but you could create a listener for various document creation events (DOCUMENT_CREATED, DOCUMENT_CREATED_BY_COPY, DOCUMENT_DUPLICATED, etc.) and then remove inheritance and set default ACL.
Something like...
DocumentRef docRef = docModel.getRef();
ACP acp = this.session.getACP(docRef);
// delete existing 'local' ACL
acp.removeACL(ACL.LOCAL_ACL);
// block inheritance
acp.getOrCreateACL().add(new ACE(SecurityConstants.EVERYONE, SecurityConstants.EVERYTHING, false));
// and then create the local ACL entries you do want
ACL acl = acp.getOrCreateACL(ACL.LOCAL_ACL);
... and then create desired ACEs ...
acl.add(new ACE("testgroup","Read", true));
acp.addACL(acl);
this.session.setACP(docRef, acp, true);
