I needed to address the same issue in my production system. You are on the right track though. McxX users are created for each Extender that registers (I now have over 9 because of all 360's I've had to replace due to the RRoD). These users are created in Vista and in W7. In my environment, I allow the Extenders to delete recorded TV only. My NAS shares are set to allow read-only for McxX users on Music, Photos, and Movies. Hope that helps.
Adam
New System: SageTV, HP EX495 WHS, 5TB, HDHR, 2x Dish ViP211 R5000hd, 5x HD200 extenders.
Retired system: MCE Server (in closet, non-viewing): HP m9000t - W7Ultimate x64, dual Cablecard, dual Maxtor 160GB RAID 1, Seagate 750GB. Infrant ReadyNAS NV-1.6TB RAID 5. Three XBOX 360's and two Linksys DMA2100 as HD Extenders.