I think this might be possible…kinda. I haven't really thought through this entirely, so stick with me.
As I understand it, you can point a file share to a particular Alfresco directory. Also, you can create a rule where each document of a particular type is linked to another folder.
What if you had an inbound rule on each incoming piece of content that linked it to a directory that is only shared via CIFS. In that way, CIFS would only have access to those documents.
Clearly, this plan is less than elegant, but maybe it would work.