I'm going to assume that you've already created folder level permissions. But, you don't mention whether or not you're running a Windows Active Directory Domain. If you are then you'll have a couple of great features up your sleeve, that won't cost you anything.
1) Active Directory Rights Management Server (RMS). This gives you granular control over access to documents, and whether or not people can email documents, print them, convert to PDFs and so on.
2) DFS namespace. Many people use DFS solely for replicating files. But a DFS namespace also acts as a virtual file-share. If people know the name of your file-server then they know a) where the files physically are and b) which server to attack! But a namespace acts as a proxy, so you can bury your files deep in your network.
Using these in combination with standard NTFS and SMB permissions will be a really effective defence. Good luck