I noticed that the /usr/local hierarchy is group-owned by the `staff' user, so another approach that I'm trying now would be like this:

1. Make (or add) a user belonging to the `staff' group.
2. Ensure /usr/local/{share,lib}/perl/$VERSION is group-writeable by `staff'.
3. Set up CPAN{,PLUS} to disable installing modules as root (even via sudo)
4. Invoke CPAN{,PLUS} as the user above to install modules.

So far so good, I have successfully installed the Titanium bundle this way, with the only stumbling being updating the Test::Simple module (which I worked around by running perl Makefile.PL INSTALLDIRS=site). I imagine this may be the case for modules shipped in the Debian perl-base and perl-modules packages.

A side effect of this is that files of the newly-installed modules will be owned by that specific user in the `staff' group, which is great if you plan to keep you CPAN{,PLUS} installations managed by a single user.

edit: this is essentially option 2 above, except there's no need to make another `local_admin' group as there's a `staff' group already (designated in Debian as the group for junior sysadmins, see Securing Debian HOWTO)