Samba4: ACLs inheritance: owner group will be changed to “domain users” in new created files/dirs

Samba Version 4.3.11 on Ubuntu Xenial server (16.04)

In smb.conf I have:

Server role: ROLE_DOMAIN_MEMBER
[global]
  ...
  inherit permissions = Yes
  inherit acls = Yes

  # I needed this due to another issue
  server max protocol = NT1
  max protocol = NT1
  protocol = NT1
  ...
[institute]
  ...
  map acl inherit = Yes
  store dos attributes = Yes
  vfs objects = acl_xattr

I'm always setting/administering the shares from the linux side.

I've set a directory's acls like this:

# getfacl .

# file: .
# owner: rawi
# group: hg_pat
# flags: -s-
user::rwx
group::r-x
group:hg_qm:rwx
mask::rwx
other::---
default:user::rwx
default:group::r-x
default:group:hg_qm:rwx
default:mask::rwx
default:other::---

Now I create underneath it a directory TEST from the Windows Client side and I look at the acls:

# getfacl TEST

# file: TEST/
# owner: rawi
# group: domain\040users
user::rwx
user:rawi:rwx
group::r-x
group:domain\040users:r-x
group:hg_qm:rwx
mask::rwx
other::---
default:user::rwx
default:user:rawi:rwx
default:group::r-x
default:group:domain\040users:r-x
default:group:hg_qm:rwx
default:mask::rwx
default:other::---

… the standard group is now "domain users", but not all should have any rights here, but only the group hg_pat (r-x) and hg_qm (rwx).

btw. with or without the following in the config doesn't make a difference in the inheritance

map acl inherit = Yes
store dos attributes = Yes
vfs objects = acl_xattr

Without acls with only one group allowed is no problem: the sgid is doing this well.

But needing two groups allowed with different rights and thus needing acls, samba inactivates the sgid and adds the unwanted "domain users" as "CREATOR GROUP".

How can I avoid this group change and get a clean inheritance?

Thanks

Rawi