This is one thing that Windows still seems to do much better than Linux--a few clicks, or perhaps, type a few key words into help, and you're done.
A good and understandable article on access control lists, even though dated (written for Fedora 2), is at
As for doing X for one group and Y for another, the only thing I can think of off the top of my head is to have two directories, say, one directory for accounting and a second directory for support. If you want to do it with individual files, where accounting has read permission and support has read/write, ACLs are about the only thing I can think of. Unless Linux's GUI samba admin tools have improved a great deal since I last used them, it's easier to put them on a Windows server.
The last time I had to set anything like this up was on a CentOS 5.x box, and I used ACL's. Our samba setups are usually pretty primitive, and for most things where we do very granular permissions, we use Windows.
That link that Beaker provided looks very promising though--it looks as if it's made it as easy to do as MS.