For a start you should never allow outside access to the root partition (Volume_1).
Read the manual section about setting up users and groups. You should be able to setup a user that has only access to a particular folder with that and the root directory protected by different user/password combinations. With that folder setup, move your pictures there and make that folder available to your clients by giving them the user/password for it. That way the pictures are available but the remainder of your data is not.