use some file system with snapshots and differential backups, like ZFS, and snapshot it daily. Stream the diffs somewhere they can’t login to and which doesn’t mount the FS.

This will invariably save their bacon at some point.