Did I miss something?
Don't understand why the user won't use OwnCloud?
It is relatively easy to set up and use on a Debian platform, a little harder to set up on IIS, but doable.
Security is in the eye of the beholder, both platforms can be locked down to nearly anyone's requirements.
Inquring minds and all that.....