This question has many detailed aspects to it. The following is a light synopsis.

• Personal folder space gives the user the freedom to create anything for themselves and save freely. Since its in their own user space, there is no impact on any other user.
• Work-group folders let users from the same roles create and share content easily within their own secured role groups. This offers sharing without the overhead of granular security management. not everyone likes this capability, so to block this you can elect to not to create work group folders for each role created. 
• Public folders offer administrators the ability to let users see content in a folder (granting read access to roles on that folder) while also blocking their ability to change these items in that folder or adding new content to that folder (removing write access to roles on that folder).

Combining all three avenues of content management solves the problem you describe.