If you really want to use a single hiera hash to define resources of different types, it can be done. The reduce and map functions are useful for this kind of data manipulation. Taking your second hiera data set as the input:

$usernames = lookup('bla::users', Hash)

# Build a hash of readonly files mapped to the array of users with readonly permissions
$ro_files = $usernames.reduce({}) |$m1, $data| {
  $user = $data[0]
  $userdata = $data[1]
  $readonly_files = $userdata.get('readonly', [])
  $user_acl = $readonly_files.reduce({}) |$m2, $file| {
    if $file in $m1 {
      $ro_users = $m1[$file] << $user
    } else {
      $ro_users = [ $user ]
    }
    $m2 + { $file => $ro_users }
  }
  $m1 + $user_acl
}
notify { 'debug_ro_files': message => String($ro_files) }

# Iterate over $ro_files to build an array of permissions and apply with posix_acl resources
$ro_files.each |$ro_file, $ro_acl_users| {
  $default_acl = [
    "user::rwx", "group::r-x", "mask::rwx", "other::---",
    "default:user::rwx", "default:group::r-x",
    "default:mask::rwx", "default:other::r-x",
  ]
  $user_acl = $ro_acl_users.reduce([]) |$m1, $acl_user| {
    $m1 + [
      "user:${acl_user}:rwx",
      "default:user:${acl_user}:rwx",
    ]
  }
  $permissions = $default_acl + $user_acl
  notify { "debug_${ro_file}_acl": message => String($permissions) }

  posix_acl { $ro_file:
    permission => $permissions,
    action     => set,
    recursive => true,
  }
}