First up, if your going to be hosting a web application that you need to scale up and down then by far the simplest way to do this is using a web app, as you have no need to manage the underlying VM's, so I would first consider whether that will fit your needs.
If you have to use VM's, then using Blob storage is going to be the simplest and easiest option, what is it that you don't feel is suitable? It would help answering this to have a better understanding of your requirements.
There are a number of other storage options you could consider. You mention Azure files, buy default you are correct, it does not support file or directory level ACL's, however there is a preview feature that allows you to do that.
Alternatively you could look at Azure NetApp files. This is more expensive, but does provide full ACL's.
You could also look at hosting your own VM based file server.