CiviCRM Webform - enforce ACL permissions
Have you seen this extension:

https://civicrm.org/extensions/relationship-permissions-acls

It makes the permission flag on a relationship work like a true ACL.

But then perhaps you don't have relationships to work with?

So:
- create a relationship between your Primary Contact and the Contacts he/she has access to [e.g. Counselor and the kids in the Youth Program]
- via webform_civicrm and the additional extension above you can pull in all a Counselor's Contacts on a webform -> with enforce permissions true
- don't allow the Counselor to create new contacts - and lock a Contact's fields; that way the activity can only be created if the Counselor has the necessary permissions to view that contact.

To make the form not accessible to certain users who don't have the necessary permissions in CiviCRM (ACL) -> put your ACL allow users into a CiviCRM Group -> then use GroupRole Sync module to assign these users automatically to a Role when they login -> then configure your form such that only users with that role are allowed to Submit the form.