I think @juliejohn is trying to create an environment where users essentially have a private SMB share which is often referred to as a home directory which can be misleading.
Anyway @juliejohn I have this working well so let me try to explain.
This is what my ‘home3’ dataset looks like and it’s essentially just the defaults with nothing changed. Make sure when you create this dataset you select ‘SMB’ as the preset and untick ‘Create SMB Share’ as we will do that step next.
I have then created two shares pointed at this dataset. One ‘home3’ using the ‘Private SMB Datasets and Shares’ preset and the other ‘home3admin’ using ‘Default share parameters’.
Finally I’ve edited the Share ACL on ‘home3admin’ to only allow the ‘builtin_administrators’ group access.
The key to all this is that my admin user (ruby in your case) is a member of the ‘builtin_administrators’ group otherwise this won’t work. You don’t have to use this group but it does make things much simpler and means you don’t have to change the dataset ACL as it already works out of the box.
I hope this helps.