Part of the solution of finding separate Office access should be getting your public computers on a different local area network (LAN) than your staff computers. If staff files are showing up on public computers that also means public computers can access staff computers. The threat would be if a patron were to accidentally download malware such as ransomware from say their private email it would propagate to the staff computers if they are all on the same internal network.