Here we will install

Samba

Create the "homes" share

Edit the samba config to add the new share for home dirs. This will be users home dirs

Add to he end of ** /etc/samba/smb.conf **

[Home]
comment = Home folders
path = /mnt/data/homes
valid users = users
read only = no
guest ok = no
create mask = 0775
directory mask = 0775

Create a generic share

Under the /mnt/data (the encrypted disk) let's create a new directory, e.g. videos. This will be assigned to administrators group

mkdir /mnt/data/videos
chown services:services /mnt/data/videos
chmod 776 /mnt/data/videos

Create a couple of groups, the first will have write access

groupadd share_videos
groupadd share_videos_readonly

Add the users. Johnd will have readonly access

usermod -a -G share_videos main
usermod -a -G share_videos_readonly johnd

Edit the samba config to add the new share. You can add the "veto files=..." to hide certain dirs

Add to he end of ** /etc/samba/smb.conf **

[Videos]
comment = Videos
path = /mnt/data/videos
read only = no
guest ok = no
create mask = 0775
directory mask = 0775
force_user = services
force_group = services
read list = @share_videos_readonly
write list = @share_videos

Add/Remove users to/from share

It will be enough to add the user to the group share_name e.g

usermod -a -G share_wetheaver_readonly johnd

Set samba to start AFTER mnt-data.mount

Create another systemd

** /etc/systemd/system/smbd **

[Unit]
Description=Start smbd service
After=mnt-data.mount
Wants=mnt-data.mount
StopWhenUnneeded=true

[Service]
Type=oneshot
ExecStart=/bin/sh -c '/etc/init.d/smbd start'
RemainAfterExit=true
ExecStop=/bin/sh -c '/etc/init.d/smbd stop'
Restart=/bin/sh -c '/etc/init.d/smbd restart'