I know I haven’t posted since December but I’m still interesting in this, just focused on other things.
I’m not quite sure what you meant by this. The setfacl stuff looks good, that’s exactly what I had in mind. For mapping, NFSv4 has idmapd, which is trivial to set up. See my earlier post.