"Another thing is how should I throw the errors if X or Y user is not supposed to be there."
If a user ends up on a page they shouldn't be I:
1) store a message explaining what happend in a session var. (ie "You don't have permisson to access x.")
2) redirect the user to another page
3) display the message stored in step1.

For step 1 I use a class similar to the zf built in flashMessenger (action helper)

As for the acl, your suggestion will work. Theres a million ways to do it. Just continue on your current path. As you get more comfortable with the code you can always go back and tweak it.

Good luck with your game