How do I change default POSIX permissions applied to new files thru AFP

The File Sharing guide has a wonderful example of setting permissions for the Backup share point. Trouble is it fails miserably: everything anybody ever puts there from a Mac client becomes visible to the whole world because the default POSIX permissions are Others: read-only.

The SMB defaults can be changed, but not AFP, which is a natural consequence of the nature of those respective protocols.

Do I change the default at the UNIX level, and if so, what else on the entire Server does that break?

TIA for any help,
Paul