Ed,

I believe you need to give explicit permission on the actual document for this setup to work because the shortcut leads to the actual document and becomes subject to its permissions.

When you create the shortcut, you would also grant that user rights to access that specific document, or you could create a tag that grants them access and just assign the tag to new documents.

Even if you give them permission to view the document they won't be able to access the parent folder without permission so security should behave the way you want.