I spent an entire day searching the same topic. Here's what I found and tested on Debian 9 + Samba AD DC 4.5.12:
In order to set sharing folder permission, a somewhat local UNIX group or user must be present.
Option 1: Create Group with GID
I failed to map the GID after creation by net groupmap, but was able to map them at the time of creation by:
groupadd localgroupnamewithoutspace
cat /etc/group
samba-tool group add "Group name with space" --nis-domain=mydomain --gid-number=corresponding gid we just saw in /etc/group
chgrp localgroupnamewithoutspace /path/of/share
chmod 0770 /path/of/share
Option 2: Look up GID of AD group
UNIX groups don't allow space, so set the group of the directory to its GID; it will work.
However, when doing ls -al, it will show the GID number not the AD group or UNIX group name. This could potentially be a problem if multiple groups are nested and assigned in the same large sharing parent directory.
wbinfo --name-to-sid "AD group name with space"
wbinfo --sid-to-gid "Copy from the output above"
It should look like this, and you only need this part S-1-5-21-53980404-2501955692-3283166571-512 then use the GID number when setting permission by chgrp, chmod.
Noted, The above only takes care of AD group and Unix group mapping, the actual ACL and group member permission still requires having proper SeDiskOperatorPrivilege setup, and then configured through Windows Client with account has SeDiskOperatorPrivilege in File Explorer and ADUC.