What you describe probably sounds like the best option. To show a button for the Open Graph Action, you just need to use the {JFBCAction ..} tag, which can be placed in a Custom HTML module. That module can have whatever ACL permissions you want.
With that said, Open Graph Actions are not as much meant for wide-spread promotion. They are specifically for posting back to a user's Facebook Timeline the activity they took on your page. Limiting that to just paying users is a very limiting choice in general since the user that's posting the content would still be able to Like or Share the content on Facebook, which is a great choice for promotion anyways. I don't know if I'd use the option for Actions for the own user as an upsell. I guess, if that's the route you really wanted, you can sell a listing that has an action button vs a lesser/free one that doesn't.. that way, all the visitors that see the listing can choose to use the action. It still seems like that's a strange (and hard to explain) limit though.
Of course, it's your site, and I don't know what your plans or model is, but thought I'd give my feedback.
Thanks,
Alex
Use ACL to control who can have access to Open Graph
