Maybe one way is to use the opposite of my redirect idea. That is, is a page is requested for /users/* and that page doesn't exist under the subsite replacement, fall back to acs-subsite.
This way for the majority of requests no redirect would occur.
