i guess there is a setting for that..

do you already have advanced permissions turned on ?

if you dont, go to features tab and check use advanced perms " This will turn on the advanced User and Group permissions tabs for this blog."

then you notably "the advanced User and Group permissions tabs for that blog" will appear at the end of the tabs row. Click there and click group perms, and also click on any group to see more settings.

oh and btw, you dont have to use the photoblog skin, you may craft your own skin, and also you dont need that do, you can use gallery or lightbox plugins , i am pretty happy with the jquery lightbox plugin of Afwas..

that's all i can recommend from what i got for now..

edit: additionally when you open those advanced perms and click on a group you will see

Files:
*No Access
*View files for all allowed roots
*Add/Upload files to allowed roots
*Edit Allowed unlocked files
*Edit all files, including Blocked locked ones . Needed for editing PHP files in skins.
This setting will further restrict any media file permissions on specific blogs.

As far as i know;

No access: no need to define that, user has no upload permissions
View files for all allowed roots: this seems to cure your problem, you can set the user not to be able to reach root directories afaik, cheers