Jack,
First step is to remove the network share so they can no longer see the payrol folder. Then give them privs to the payrol folder only, not to the whole server, so they can't browse their way to the folder. you might consider adding a few extra folders as well to make it harder to guess the UNC. Finally, use a SET PATH at the start of your app so it can find the UNC itself! We put the UNC into an encrypted file that gets copied to PCs along with the app.
"... They ne'er cared for us
yet: suffer us to famish, and their store-houses
crammed with grain; make edicts for usury, to
support usurers; repeal daily any wholesome act
established against the rich, and provide more
piercing statutes daily, to chain up and restrain
the poor. If the wars eat us not up, they will; and
there's all the love they bear us."
-- Shakespeare: Coriolanus, Act 1, scene 1