@keneda I do not have a complete solution for everyone, just what I did:

0. export LD_PRELOAD= (libtls-padding.so causes unexpected things)
1. boostrap chroot filesystem as per https://wiki.debian.org/Debootstrap
2. mount /proc and /sys, bind mount /run/dbus (optional for smbnetfs) and /dev (fuse there)
3. chroot in with 3003 (and optionally 3004) supplementary groups
4. add apt_ user to 3003 (and probably 3004) groups
5. edit /etc/resolv.conf with nameserver of preference
6. install smbnetfs with apt-get, configure as per https://wiki.gentoo.org/wiki/Smbnetfs (I only needed auth line)
7. mount smbfs in chrooted environment with allow_others option
8. on a host filesystem as a phablet user create a symlink under Downloads (any folder accessible by filemanager without unlocking is fine) to the required share(s)