What would be the correct combination of NTFS special access permissions to allow an AD group (Authenticated Users) to copy files to a share, but after copying no one in the AD group should be allowed to edit, overwrite, rename, or delete the file? The AD group should also be able to copy files from the share to their machines.
I'm assuming your are getting your definitions from here. It is a little confusing, what you want to watch out for when setting that particular permissions is the "Applies to" drop down. If you apply it only to folders(/subfolders/...) then you are good, if you apply it to file objects as well then the user will be able to overwrite what is there already.