There is a share option ‘abe’ (access based enumeration). If enabled on a share, clients will only see the files they have some sort of access to. You could try disabling that and see if the results are more what you expect.
I suspect the difference in behavior is probably related to when specifying an exact filename as a parameter to ls, it tries to do a stat(2) (or the SMB equivalent), while a glob will get expanded by the shell, and the needs to enumerate the contents of a directory (which is where the abe option may come into play) to figure out what the expansion is (which if it succeeds, is then passed as parameters to the command).