How in linux to assign default permissions for a directory and all created, copied and transferred files and directories in it?

Question

linux

Greetings!
There is a machine running GNU/Linux Debian Sid. It is configured to authorize Windows domain users. All domain users are included in the Domain Users group.
There is a "ShareFolder" directory (access for "domain users" - rwx), to which symlinks are created to the home directories of users (and all new ones via /etc/skel). This directory is also shared by Samba as "Shared Documents" (valid user = "@domain users").
In the Samba settings for the balls, the following parameters are specified:

[Общие документы]
   comment = Общие документы vt-4
   path = /var/ShareFolder
   read only = no
   create mask = 0660
   directory mask = 0770
   force group = "пользователи домена"
   valid users = "@пользователи домена"

That is, no matter what users do in the ball, all data will be available by rights. But, local users do not have such settings and can create a directory / file that will not be available to other users either locally or through the share.
Actually the question is how to implement "create mask" and "directory mask" for local users?
I came up with/found several solutions:

• ACL - assign by default for the "ShareFolder" directory the "domain users" group and "mask" values ​​rwx.
  But, then all files will be with execution rights, and this is not very good.
  
• fstab - move the "ShareFolder" somewhere and mount it in its place, but with umask=0 0 7.
  But not all users have the "domain users" primary group. Yes, and this applies only to the created files.
  
• cifs - mount the ball by analogy with the previous option.
  So far, the most "clean" result is the output, but there are too many intermediaries.
  
• pam - I'm not sure, but if you add "session optional pam_umask.so umask=0007" to
  /etc/pam.d/common-session
  /etc/pam.d/common-session-noninteractive , then even when copying, the rights will change.
  But this is a global option and how to make it work exclusively for one directory is not clear.
  

Waiting for your suggestions.
Thank you.