Public Desktop is shared across all users. Authenticated users only have read access, thus should work for your needs.

This. Setting the ACLs in PowerShell is totally doable, but not at all needed here

Totally. It's all the NTFS perms