thank you for your imput - I found a dirty but working "workaround":
I give everyone access to the shared folders - so every enabled user
has access to the shared folders
I set access-denying ACL's on the 3 main folders for every user who
is not allowed to access.
And thats working with my (strange) configuration.
Again - thank you very much for your help Brian ... i think I close
the topic an sleep well again :)