So NFSv4 acls don't ignore the umask as far as I can tell. And nfsv3 with kerberos has its own host of problems (with autofs - race conditions with pam).
So if we want to use an nfs like system with autofs support what alternatives are there. I've heard of AFS but it is not suited for what we need. (Autofs mounts the home directories for a few thousand users from 3 different nfs hosts). ACLS are used for giving access to repositories and other directories to users that don't happen to be in the same group and adding them to groups would not be easy (for them).
We originally went with nfsv3 but that has security problems and group issues (sysauth) so we went to nfsv4 with kerberos and it worked great, until we tried to do acls. In nfsv3 acls were nice and easy we could set the default mask to be inherited but for nfsv4 there is no such functionality.