Proftpd has a built-in sftp server that would allow you to completely segregate users from sshd for the purposes of file transfers. You can set it up so that it uses a completely separate passwd file to even further isolate them (it's hard to login to a system with ssh and break through a chroot if you don't actually have a user in /etc/passwd ...)
proftpd also allows you to chroot and isolate the sftp user to a set of directories pretty easily.
We do something like this:
# from http://www.proftpd.org/docs/howto/NAT.html
PassivePorts 27001 27050
ExtendedLog /var/log/proftpd/access.log WRITE,READ default
ExtendedLog /var/log/proftpd/auth.log AUTH auth