how it is possible to deny access to a folder, but execept some subfolders in it from "deny"?

I tried something like this (in this order):

#this subfolder shouldnt be denied and php scripts inside should be executable

location ~ /data/public { allow all; }

#this folder contains many subfolders that should be denied from public access

location ~ /data { deny all; return 404; }

... which doesnt work correctly. Files inside the /data/public folder are accessible (all other in /data are denied as it should be), but PHP files are not executed anymore in the /data/public folder (if i dont add these restrictions, the php files are executable).

What is wrong? How can it be correct? I think theres a better way to do it.

It would be very nice if anyone can help me with this :).