Using kodi advancedsettings.xml to exclude external hard-drive paths, then password-protecting them via samba shares

advancedsettings.xml

<!-- File: ~/.kodi/userdata/advancedsettings.xml -->
<advancedsettings>
  <audio>
    <excludefromlisting>
      <regexp>^/media</regexp>
      <regexp>^/mnt</regexp>
    </excludefromlisting>
  </audio>
  <video>
    <excludefromlisting>
      <regexp>^/media</regexp>
      <regexp>^/mnt</regexp>
    </excludefromlisting>
  </video>
  <pictureexcludes>
    <regexp>^/media</regexp>
    <regexp>^/mnt</regexp>
  </pictureexcludes>
</advancedsettings>

smb.conf

# File: /etc/samba/smb.conf

# ... skipping all the global settings I don't actually remember changing
# P.S. Watch out for symlinks -- samba doesn't follow those, by default

#======================= Share Definitions =======================

[kids-media]
comment = Kids Media
path = /srv/media/kids
writeable = no
only guest = yes
browseable = yes
public = yes

[family-media]
comment = Family Media
path = /srv/media/family
writeable = no
only guest = yes
browseable = yes
public = yes

[all-media]
comment = All Media
path = /srv/media
available = yes
valid users = pi
read only = yes
browsable = yes
public = yes
writable = yes

~README.txt

My external USB hard-drive contains both children's content and parent's content.

The drive seems to be automatically mounted under /media/<Label> whenever it is plugged in,
but I was able to mount it wherever I choose (under /mnt, for example) by using custom udev rules. See also:
  https://gist.github.com/eib/bfbbf8fbdb8b221223a6

In order for kodi not to serve all the parent's content even while the children's account is logged in,
you will need to exclude the hard-drive's path for all users.

However, in order to serve the parent's content while the children are logged in,
I created a password-protected samba share containing it (and can create a desktop shortcut to the share folder).