Blog mentioning WCM blanket-access:

http://www.optaros.com/blogs/understanding-differences-between-alfresco-s-repository-implementations

It says granular access is possible using API.

A blog detailing how to restrict content creation using role-based Web Forms:

http://www.skuro.tk/2010/01/12/alfresco-acl-on-wcm-webforms-an-howto/