You can filter what you are syncing or create a db per user and declare interactions with foreign data in their own instance, which will be executed according to permissions in the backend.

What I actually want is MeteorJS with neither MongoDB or the JavaScript backend, or PouchDB without Couch, or Jaydata + ASP.NET WebAPI with more open source compatibility...