ACLs: allow read and traverse folder, deny execute

On Windows NT (any version), how can I deny the execution by a specific user or group of any file whatsoever within a given directory tree, without making directories themselves impossible to traverse?

(I tried to do this to this on my Windows 8 test VM, and the best I accomplished was getting lots of errors to the effect that Windows "failed to enumerate objects in the container" because access was denied.)

Edit: further requirements...
- Limited users must retain their rights to read, write, move, and create files within the directory tree
- New files and directories created in the directory tree must inherit all of the above permissions