I am not 100% clear as to when the following is required in smb.conf on a member server:

vfs objects = acl_xattr
map acl inherit = yes
store dos attributes = yes

https://wiki.samba.org/index.php/Shares_with_Windows_ACLs#Enable_extended_ACL_support_in_smb.conf

I have confirmed Samba is compiled with ACL support:
[root@CentOS7member ~]# smbd -b | grep HAVE_LIBACL
HAVE_LIBACL
[root@CentOS7member ~]#