I remember seeing this topic explained a few years ago but cannot find it:
Can I somehow prevent Cockpit users from saving assets in the root of the project folder (and instead save in the storage directory)?
I know how to customise the backend for specific user groups and control what they can access. Will defining the finder.path in the config.yaml/.php work?