Security access is integrated with the application server. There are three security levels that you can use.
Security is handled by the application server hosting the EMLInbox. You will create roles in the application server and then add users to those roles. No user names or passwords are stored within this application now.
Since the user/service account that is running your application server is the one that accesses the EML files, individual users do NOT need access to the folder or files on the server. You will need to make sure the service account running the application server has full access to the folder (and files) where the EML files stored.
The system never displays the folder location to the users. This hides the actual path to the EML files from the users. Ignorance is not a great security model, but it is one. :)