This is how I have been doing things for awhile. All my shares are set to Secure, with only my Cache drive set as Public. All auto-downloading (Sickbeard & SAB) and Crashplan backups work without issue, and all media players only need read access for playback. When I manually add files to my server, I put them on the Cache drive in folders matching share folder names so they get moved to the array by the Mover. (I have a blank folder hierarchy for my shares saved to a Temp folder on my Cache drive that is Cache-Only so it doesn't get moved. I can copy that folder hierarchy to the root of the cache drive and then places new files in without having to create folders with the exact same name as my share folders). And if I need to move files around on the array, I just temporarily change the Share to Public, make my changes, and then switch back to Secure.