I have read that it is recommended that each different service or task on a server be given a different user, in order to keep things separated from each other. Is this true?
Ideally you'll want to do this but it also depends on your setup. Will you have guests over that might want to access a folder on your server? If so you can either share that folder through samba and give it 775 permissions, or you can create a "guest" user and give the folder 770 permissions and have you guests login as "guest" with a preset password.
Samba and/or NFS (I will be connecting with Mac and Windows clients; should I use only Samba, or both?)
If you have Windows computers in the mix you'll have to use Samba, but it's typically slower than NFS. I haven't had good experience with NFS on OSX but both are easy to setup but i'd start with Samba since it works with Windows, and OSX. You can experiment with the NFS if you don't like Samba. However with NFS you'll probably have problems with your UID not matching with your username on the server.
/etc/samba/smb.conf is the file you'll want to edit to share files via samba.
with NFS you'll want to take a look into the /etc/exports file.
What would be the proper layout of users and permissions to ensure that, for example, the directory where all my media files live is accessible to all while also keeping each service separated by user account?
I would create a group (like "users") and when you create new users if you want them to have access to something like the "media" folder make sure they are in the "users" group and make sure the "media" folder is in the "users" group and that the "users" group has access to the "media" folder.
The way i do it on my server which runs a lot of similar programs is like so:
All media is in /opt/media and /opt/media belongs to the "users" group. I then have a few accounts for me and my roommates that are all in the users group. The file permissions for /opt/media are drwsrws--- "s" means that when my roommate "bob" drops a file in /opt/media it automatically belows to the group(users) that the parent dir belongs to. So now the file that "bob" created is owned by "bob" and in the "users" group. This is typically the setup you want when a log of different people are using a shared directory.
What you want to do is a little complex and might change based on how many users are accessing the server and how your network is setup. However hopefully what the above will put you on the right path.