Adding user with specific privileges

I have a user with full read-write access to all the shares. How do I add a user with only read access to all the shares, except for a few specific share or a specific directory under a shared directory which he can also write, while prohibiting guest access? Can this be done?