Great you got that working and thanks for posting back.

As for your sharing requirements, I'm not sure if it's the best way, but the way I set up my shares is use Samba permissions to allow read access to shares (but set them to read/write for all that you want read access) and then use Linux file permissions to control write access. Assuming that the Samba and Linux user databases are correctly synced this works really well for me - only users/groups with Samba permissions can see the shares and only users with Linux permissions can write to them.