It’s totally up to you.
However, the 1st example you give implies that you are running in single-user mode, ie: the user is directly opening the books on a shared drive on another computer – there is no NewViews server program in the mix. In this case the user would require access to the data.
To operate in multi-user mode your presumption is correct – the individual users do not require any direct access (rights) to the drive/folder the books are stored in. Only the server needs access to the files.
I hope that answers you question, but feel free to ask again if I simply confused things further.