authz: exclude a user from all directories, save some

There are N+2 directories in a flat structure:

trunk/a1
trunk/a2
...
trunk/aN
trunk/x
trunk/y

I am looking for an authz configuration which satisfies the following:

1. User A shall have access to all directories.
2. User B shall have access only to trunk/x and trunk/y.
3. User B shall be able to check out trunk/x and trunk/y
   by just checking out trunk.

The point is that it seems that goal number 3 requires that user B has at
least read access to trunk. But then, this access is inherited by all the
subdirectories. The only way I see right now is to then exclude user B from
each of the a1, ..., aN directories explicitely:

[/trunk/a1]
user_B =

[/trunk/a2]
user_B =

...

[/trunk/aN]
user_B =

This, however, will become a nightmare to maintain.

Hopefully there is some trick to do it in a better way.

Unfortunately, it is not possible (at least not desired) to have a1, ..., aN
in a separate subdirectory, which of course would make the task trivial.