Users need fairly full permissions on the folder so the locking
file (LDB) can be properly managed. You can give them delete
perms on the folder but not on your MDB file but you will have to
reset that every time you compact the file.
They don't actually need delete permission on the LDB file -- when
they log off, Access tries to delete it and it fails silently, with
no repercussions.
The only drawback of this (and I've done it in production apps) is
that if corruption develops in the LDB it stays around because it
never gets deleted. One way around this is to give certain users who
are trusted not to delete the file (your managers, maybe; or maybe
not!) by putting them in a user group that has delete permission on
the file. This means that any time one of those users is last one
out of the database, the LDB will be deleted. I've done that with
production apps and it works.