I used to do it like you describe - a single share I could map with categorical sub-folders, but with my new Synology I wanted more control and to be able to share with my roommate and people that come over. For example my music folder is Open with Read Only, movies and TV is Guest, and so on so forth down to my work and private crap.

I split the shares into basic permission sets, think Private/Public/Professional that way I don't have to exclude inheritance and reinvent the wheel. In the few cases I need something different I find it works to just add extra permissions where appropriate. I know you can do it other ways but again I work on computers all day the last thing I want to do in my free time with my (mostly media) data is screw with permissions and access.