We currently have it set to “Only Admin can create and delete first-level folders, file and bookmarks”.

But it is still possible to create folders in Box Drive and store files within them, but they aren’t actually uploaded to Box (as users do not have permission to create these top level folders), and they are saved locally