ACLs for Hiding Folder and Preventing Opening of Files

Question

I thought I had a reasonable understanding of ACLs, but the behavior of OS X afp shares baffles me.
I need to do two things:
Hide selected directories within a share from all members of a group.  They should be unable to see that these folders even exist.
Prevent members of a group from opening files on a share, while allowing them the ability to copy the files.  The idea is to force them to copy files to local storage in order to open them.
I'm clear the deliberately crippled control over ACLs Server.app provides is likely insufficient to the task (really?  no deny capability?  ***?).  My attempts to deny all privileges using the command line look good on paper, but in practice create bizarre effects whent the client views the share, such as the denied folders appearing to be inaccessible replications of the containing sharepoint. 
Advice will be much appreciated.
I running Server 3.0.2 under 10.9.1.  All the client systems are running 10.9.1.

Answer 1

Mac OS X is a form of Unix operating system. Unix originally used a permissions scheme which only allows defining Read, Write and eXecute permissions, for the Owner, the Group, and 'Everyone'. This is generally referred to as 'POSIX' permissions.
With POSIX permissions you could set a folder to not have write access but this means they cannot create new files, you could set it to not have eXecute permission but this means users could not view its contents. In otherwords POSIX does not have the flexibility you need.
Because of the limitations of the POSIX style permissions, a new much more powerful scheme was developed called Access Control Lists (ACLs). Mac OS X supports this scheme as well and in fact for Mac OS X 10.5 or later it is the preferred choice. With ACLs you have three main categories of permission, Admin, Read, and Write. Each of these has sub-levels of permission. In your case, one of the sub-permissions of Write is to allow (or disallow) the ability to delete files or sub-folders.
Therefore what you need to do is run Server Admin on your server, go to Sharing at the top of the Window, and then select the folder you want to adjust the permissions for, you then need to define who can and who cannot delete the contents.
Note: A folder will always have POSIX permissions listed but might initially have no ACLs defined. Once you define an ACL permission, it will always override any POSIX permissions, you can then ignore any POSIX permissions.