The answer to Question 1 is Yes, if you configure security to allow it, the default security configuration gives users a very high level of interaction and manipulation of documents.
Question 2. All qvf files are stored in the server by default but you can configure the engine to store them in different paths, I've not experimented with it much so I'm not sure about limitations.. QVD's can be written to locations throughout your network depending on the permissions given to the server service account as the folder data connections you set up.
When it comes to Qlik Sense I would say I am still trying to riddle out the "best practices" but I can tell you that when it comes to qvf files the speed at which you can open the files will matter. Just like QlikView Server a big document will have some lag while the server loads the file into RAM. I think you are going to want to be cautious when moving the files around since it could have a negative impact on your users but I do think best practice would dictate that we get them out of the C drive.