You have two primary (and slightly conflicting) requirements:
- Encryption on a per-user, not per-system bais.
- Transparent operation from the user's point of view.
Are your users reasonably Linux-capable? I'd hope so if they have root privs...
You can't just create encrypted file systems with cryptoloop on the Ubuntu server, as as soon as one user mounts it, every other user with root would be able to see the mount in its decrypted form.
One option is the commercial PGP product, and use PGP Net. Store the .pgd files on a samba share that is hosted on the Ubuntu server (I've done essentially the same but on areal Windows server share - works, but it's not multi-user). This is about as transparent as it gets - the user mounts the .pgd as a drive letter in Windows, then just uses it like any other network drive. I don't know that it will be terribly fast though, and you've still got the issue of how to securely allow Windows networking ports between your Windows machines and the server. You could VPN tunnel it (even with no encryption on the tunnel as I guess it's already encrypted), but that's going to be interesting unless you have a local box that can act as a VPN gateway - IPSec under Windows isn't pleasant to configure.
There's probably a time-limited trial for PGP Net I'd have thought, so it might be something you can try for just some time input.
One last (and not terribly pleasant) option I can think of might be to do something with a base Ubuntu server, and a lightweight virtualisation that will work on a server in AWS (Xen VMs I believe?), so that each user gets their own 'jailed' area and can mount their cryptoloop filesystem inside that, then either scp files in and out, or run Windows networking over IPSec or an ssh tunnel etc. I'm not entirely sure how well something like User Mode Linux would work in keeping each virtual session separate from others when users have root to the base machine - there's still some scope for tinkering via the base environment, but if your users don't trust each other to that degree, then they should be on their own VMs anyway!