Samba, ACL and restrictions for subset of users [closed]

Question

I want one of my share to be:

1. accesible only for selected users
2. folders (and subfolders) in that share to be accesible for read (and/or write) for subset of my users
3. all files should have nobody:my_group permissions (because of quota on the other shares)

I've setup ACL @ /etc/fstab and all that getfacl and so on works. Changing permissions from Windows station also works. But i cannot get it to work the way I want.

My smb.conf (fragments):

[global]
    workgroup = XXX
    server string = %h server (Samba, Ubuntu)
    map to guest = Bad User
    obey pam restrictions = Yes
    pam password change = Yes
    passwd program = /usr/bin/passwd %u
    passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
    unix password sync = Yes
    log level = 3
    syslog = 0
    log file = /var/log/samba/log.%m
    max log size = 1000
    dns proxy = No
    usershare allow guests = Yes
    panic action = /usr/share/samba/panic-action %d

[....]

[THE_SHARE]
    comment = The Share
    path = /VOL/THESHARE
    valid users = @users
    admin users = admin_me
    write list = admin_me
    force user = nobody
    force group = samba-groups
    create mask = 0700
    directory mask = 0700
    inherit permissions = Yes
    inherit acls = Yes
    guest ok = Yes

Selected users at THESHARE are with proper acls:

admin_me@XXX:/VOL$ getfacl THESHARE/
# file: THESHARE/
# owner: root
# group: samba-groups
user::rwx
user:user1:r-x
user:user2:r-x
group::---
mask::r-x
other::---
default:user::rwx
default:user:user1:r-x
default:user:user2:r-x
default:group::---
default:mask::rwx
default:other::---

So users user1 and user2 should by default have read only acccess to THESHARE.

Now I created a folder in my share with permissions:

admin_me@XXX:/VOL/THESHARE# getfacl user1Full/
# file: user1Full/
# owner: nobody
# group: samba-groups
user::rwx
user:user1:rwx
group::rwx
mask::rwx
other::---
default:user::rwx
default:user:user1:rwx
default:group::---
default:mask::rwx
default:other::---

So user1 should have full access to that folder, and user2 should not have any access to it.

Well, that theory. In practice it does not work. I'm a little confused where to start over all of this, maybe someone will help to point me out my mistakes.

Currently no one (except admin_me) have access to write/create folders or files, and both users are able to go through folders without permissions to read it.