Enable workspace object access control will allow to set permissions on folders (so user can have no permission to root and only to mnt).

Regarding native upload feature I don't think there is much can be done about it. I think azure explorer with correctly specify access rights is better. Some non technical users can prefer some simple cloud storage like folder on OneDrive so then we can set trigger in Azure logic apps when file is created and then set to copy it to ADLS2.