[Samba] Host based access on GNU/Linux

[John Lewis]

What ways can I implement host based access on GNU/Linux with Samba4?

I want to use Samba4 based ldap accounts to store all of my accounts for
all of my administrative users and the users of the joomla site I am
developing.

I don't want my joomla users to login to anything other than my web
server and my sftp server.

I also may want to prevent joomla users from querying certain things on
the ldap tree as well.