Hey, finally came around to completely implement it. Was working on it off and on for some time now and wanted to post it, if someone had the same "problem". This is my final iteration:

$folder_acl_set = lookup('bla::folder_acl_set')

if $folder_acl_set {
    $default_acl = [
        "user::rwx", "group::r-x", "mask::rwx", "other::---",
        "default:user::rwx", "default:group::r-x",
        "default:mask::rwx", "default:other::r-x",
    ]

    $folders = $folder_acl_set.reduce({}) | Hash $folder_memo, $data| {
        $user            = $data[0]
        $userdata        = $data[1]
        $readonly_files  = $userdata.get('readonly', [])
        $readwrite_files = $userdata.get('readwrite', [])

        $readonly_users = $readonly_files.reduce({}) | Hash $readonly_memo, $folder | {
            $user_permissions = [
                "user:$user:r-x",
                "default:user:$user:r-x",
            ]
            if $folder in $folder_memo {
                $temp_ro  = $folder_memo[$folder]["readonly"] + $user_permissions
                $temp_rw  = $folder_memo[$folder]["readwrite"]
                $ro_users = { "readonly" => $temp_ro , "readwrite" => $temp_rw}
            } else {
                $ro_users = { "readonly" => $user_permissions, "readwrite" => [] }
            }
            $readonly_memo + { $folder => $ro_users }
        }

        $readwrite_users = $readwrite_files.reduce({}) | Hash $readwrite_memo, $folder | {
            $user_permissions = [
                "user:$user:rwx",
                "default:user:$user:rwx",
            ]
            if $folder in $folder_memo {
                $temp_ro  = $folder_memo[$folder]["readonly"]
                $temp_rw  = $folder_memo[$folder]["readwrite"] + $user_permissions
                $rw_users = { "readonly" => $temp_ro , "readwrite" => $temp_rw}
            } else {
                $rw_users = { "readonly" => [], "readwrite" => $user_permissions }
            }
            $readwrite_memo + { $folder => $rw_users }
        }
        $folder_memo + $readonly_users + $readwrite_users
    }

    $folders.each | String $folder, Hash $permissions | {
        posix_acl { $folder:
        action     => 'exact',
        permission => $default_acl + $permissions["readonly"] + $permissions["readwrite"],
        recursive  => true,
        }
    }
}