User management for an AFP share
My recommendation for best practices would be to use Server.app ($20 on the App Store) to perform file sharing. The benefit of using Server.app is that it supports more advanced file sharing configuration. For example: you can set ACLs (Access Control Lists - a list of permissions) on different folders for the group access that you want in System Preference -> Sharing. However, by default those ACEs (Access Control Entry - a single permissions entry in an ACL) will not support permissions inheritance. Permissions inheritance keeps file permissions in the share point set correctly (so that the entire group continues to have read/write access). The absence of inheritance becomes problematic when one user of the group has written a file to the share, and another user attempts to modify it - by default, the ACL that specifies read/write at the root of the share will not have inherited permissions to descendant files/folders

The best way to manage the permissions on a share point is usually to do it by creating groups. That way, you can set the permissions on share points to allow group access to the folder/share. This makes it easy to provide users access to that share in the future, as you'd simply add them into the group. For example: most "normal" users (including the "admin" users) should be part of a group that's allowed access to the general-use shares (or all shares, as you've mentioned). Your "admin" users will be part of a group that has access to the other "restricted" share points. Setting each of those groups up as an entry (ACE) in Server.app -> File Sharing will allow permissions inheritance to occur.

If you really want to use the System Preferences -> File Sharing setup to serve files, I'd recommend using System Preferences -> Users &amp; Groups to create groups to control access. However, be aware that you will likely run into permissions problems somewhere down the road.

Although you can use chmod on the command line to specify ACLs that do support inheritance, it's a little bit cumbersome for some users.