But, given that CVS really is the solution you are stuck with, the procedure you outline is the recommended one. CVS supports this with the import command:

import
   Import sources into CVS, using vendor branches
       · Synopsis: import [-options] repository vendortag releasetag..
[download]

There are many alternatives to CVS, perforce and subversion being proprietary and free options respectively, and many of them may handle this task more or less better than CVS. But the real complexity is in the subsequent merge of the vendor branch into your mainline. None of the VC systems do this hard work for you.