If you set this up as you outlined, then adding the user to a group will grant the user access the access specified by the group.
Usually, objects created in a share always inherit the permissions of the parent folder. The changes are often done by administrators where the main folder has write access by all, but need to limit write access to subfolders.
i.e. parent1 has write by all, but child1 needs only to allow write access to group1. One of the ways this is done, child1 is separated from parent1, and only group1 is set to write.
setting up a deny group complicates things since it is difficult to audit.
i.e. user1 was initially added to a deny group to prevent access to subsubsubfolderofchild1 by admin1.
Months go by and now user1 needs write access to subsubsubfolderofchild1. admin2 goes through process and adds user1 to writeaccessgroup, but the deny group has precedence and user1 still can not write to subsubsubfolderofchild1.
Everything starts from the design/layout of the share.
