Thank you. I’m closer to what I want now. Can you help me explain this behavior though:

For testing purposes, I commented out every line in /etc/exports but these:

/srv/nfsv4              192.168.0.10(ro,sync,secure,root_squash,subtree_check,fsid=0) \
                        192.168.0.20(ro,sync,secure,root_squash,subtree_check,fsid=0)

Client 192.168.0.20 can mount nfs-server:/ and listing the contents gives both directories foo and bar. It cannot see the contents of foo, as intended, but it can see what’s inside bar. I cannot figure out why? I rebooted the machine in hopes it was just a caching thing, to no avail.

Apart from that, I was hoping 192.168.0.20 could not even mount foo, but as long as its contents are hidden, I can live with that for now.