Finally got it to work:
I managed to do everything using ACLs:
1) create: create a script or add roles. do NOT use reference fields at this time, because they will not be populated if there is no embedded record yet
2) write: this is the rule that determines who can write OR CREATE a record. If people have create roles but no write, then they cannot write to the "new" record, hence they cannot actually save the new record and no new record will be created. This means that the create may be less restrictive than the write rule.
3) delete: (optional) if you want users to be able to delete, set this ACL.
4) list_edit: don't forget to set this one, especially if you have removed these rights to prevent little accidents.
