If you allow access to the file system, realize that the SSIS packages will execute from wherever the dtexec command is given. So if it's given from the user's workstation, that's where it runs.
Do you mean if the SSIS package is deployed to a server directory. And the user connects using a UNC path \\servername\foldername; when the user executes the package, is it still running from the user's workstation?
If there's a ftp task on the SSIS package, for example, FTP to say, D drive - does this mean it'll ftp the file to the user's workstation's D drive and not the server's D drive?