Different Entity Security in Different Cubes and/or Scenarios

It won't be pretty, but I can't think of another way. Like you say, you would grant access in entity security and take it away in data access security. I don't think there is a recommended limit to data access security, especially if it is the only way to accomplish a goal. I have seen as many as 800 lines. It was not a joy to maintain but worked otherwise.