When creating a user, bind them to a folder, then when they login with said user, they only see that folder. That’s the way I’ve been handing out uploadable links.