Is ACL active with network protocols (afp, smb, ftp)?
Does network shared protocols respect ACL permissions on files and folders? AFP, SMB, and FTP? I can imagine that it should be fine for the first two, but since Lion Server stopped "enabling" a FTP server, its suspect if it will adhere to it. Even more suspect that a 3rd party FTP server would still follow permissions (likely have to add second layer of users for ftp only, with specific permissions).