ACLs are super simple and work well, just dig into them. I use groups as rbac (one group per role), and share parts of my network with friends/family (game servers), and colleagues (work collab stuff, such as live coding).

Toggling users on/off also works great, and disabled users don't count towards the limit.