If I understand your plan correctly, I have used virtual domains for the 'real' domains hosted on my SME box. My primary domain is domain.lan and is not reachable from the internet, only the local network.
Try this for every domain on sme (example mydomain.com):
1. Create group on sme called mydomain_
2. Create ibay called mydomain and allow group mydomain_ write access.
3. Create virtual domain mydomain.com and point it to the mydomain ibay.
4. Assign users to the mydomain_ group.
With ftp or ssh, the users should have access to the ftp and html folder or the site(s) they are assigned to according to the groups they are a part of. Additionally, these users will have samba access to the files directory from Windows PCs on the LAN.
good luck
ryan