Sub Dataset permissions

[Newtofreenas]

I am trying to figure out how to limit permissions. I basically want certain groups to have access to sub datasets but not the main dataset. folders inside the folder but not the main folder. As I am sure this is possible, I would love to know how to do it!

my data sets setup
/tank/fruit
/tank/fruit/apples
/tank/fruit/bananas

I would like group apples to not have access to the folders in fruit or the dataset of bananas, ideally not even see the bananas folder.
same with bananas group to have access to bananas dataset only, but not to apples or fruit folders, or even see apples folder.

Do I need to add more datasets or am I not understanding the permissions.
Do my datasets need to be
/tank/fruit/files
/tank/fruit/apples
/tank/fruit/bananas

the /tank/fruit folder has many folders inside it, made in windows not as datasets.


My current understanding is that in order to have access to sub datasets you must first have access to the root dataset. If I block apples to /tank/fruit dataset then they cannot get to /tank/fruit/apples even though it does say allow in apples because they are already blocked in fruit folder.

Any help on this would be greatly appreciated, either on proper way to layout datasets or make permissions work for what I have.