Just to be sure, are we possibly confusing home folders and home directories?

Its very common to do, it seems and I've done it myself when talking to folks.
If their home directory is on the server, everything that's placed in that home, which should be all of your user data, since they wouldn't have permissions to other areas on the system, should be on the server.
If you really wanted to be sure nothing touched those internal drives, you could always diskless netboot all of the clients.
