Theoretically it can be done. As you can read here
] samba(share) rights and ntfs rights are not related. So if you make the proper combination, you get what you need. I takes a little bit of tuning, but you can experiment on much any PC with XP and up, as NTFS and windows share rights management has not changes ever since...
As I see, this is much the same question: http://serverfault.com/questions/458611/ntfs-share-allow-file-read-deny-list-folder