Am I going to have to create a acl_users in each of these sub folders, of can I authenticate them in the parent folder only?

No, and yes. Although you could do both.

If so, how do I restrict them to the specific folders ( and child objects of this folder)?

Local roles are beautiful. Look at the link in the big block of descriptive text in the Security screens. (Yes, I ignore that too.) --jcc (lovely links)