I have a gallery user. Let's call him "Bob". Bob has a primary album linked to his account. In that primary album he can publish sub-albums for his various vacations etc. These sub-albums will be accessible only to those with privileged access to his primary album. For example, with a user account called "VIP". What is the best way to do this... Make "Bob" a managed album for VIP?

Then, how do I achieve this:

Bob wants to create unpublished sub-albums under his primary album, which would be accessible only to him.

You can only assign top level albums to specific users. So if that album is private (so best unpublished and password protected) sub albums inherit that status. Also take a look here:
http://www.zenphoto.org/news/an-overview-of-zenphoto-users/#rules-of-protection-andvisibility-for-zenphoto-obj

I'm finding the user management in Zenphoto very cumbersome, and a major hurdle in adopting the software. I think Zenphoto could benefit a lot from a simpler more intuitive interface, like Mac OS file permissions.