Can't you just force outbound encryption and disable upload? You'd only be receiving the file, not redistributing it.