I don't follow you.
If I go to http://mysite.com/admin/site-map/ then I see something like this:-
URL Instance Name Package Type
(-) my_subsite/ My Subsite ACS Subsite [ links 1 ]
blah_1 Blah 1 Package A [ links 2 ]
blah_2 Blah 2 Package B [ links 2 ]
blah_3 Blah 3 Package C [ links 2 ]
Where [ links 1 ] is [ add folder | parameters | permissions | rename | delete ] and [ links 2 ] is [ add folder | unmount | parameters | permissions | rename | delete ]
What I did was to choose permissions in [ links 1 ], i.e. at the ACS Subsite level. To my mind this will control permissions at the subsite level and not at the level of a package mounted under the subsite, such as blah x.