Another thing I forgot to mention is that your web server traditionally runs as "nobody", meaning that the last set of permissions for everyone else needs to include readability if you want the files to be accessible to the web server.

As long as your samba server is doing some authentication before letting people at your web directory you should be all right. It's also always safer to specify which IP addresses can access the samba server in the config file.

Matthew