Restrict Share Access to either a FSx file system or FSx file gateway

I haven't used the FSx File Gateway myself, but documentation clearly agrees with what you're saying @Dan Adams: https://docs.aws.amazon.com/filegateway/latest/filefsxw/what-is-file-fsxw.html#file-gateway-fsx-concepts:

FSx for Windows File Server makes all the shares on the server available as shares on your Amazon FSx File Gateway. You can then use a client to browse and connect to the file shares on FSx File Gateway that correspond to the selected FSx File Gateway.

FSx File Gateway maps local file shares and their contents to file shares stored remotely in FSx for Windows File Server. There is a 1:1 correspondence between the remote and locally visible files and their shares.

That means the solution isn't intended to be used such that access permissions would differ between the parent FSx file system and the FSx File Gateway. You can restrict network access to block access to one or the other, but that would affect the whole systems relative to the source networks, instead of operating at the levels of individual shares, users, or user groups.