If you allow access to the file system, realize that the SSIS packages will execute from wherever the dtexec command is given. So if it's given from the user's workstation, that's where it runs. When you use SQL Server Agent jobs, it's running from wherever the SQL Server Agent is running. That's the biggest hump to get over is to understand where the execution is.

For SSIS related roles in msdb, here's an explanation of what each does (from Books Online):

Integration Services Roles (SSIS Service)