According to this post on StackOverflow the storage should be separated.
Each user gets their own space on the emulated storage which other users cannot access to read or write (assuming the device is not rooted, in which case all of this goes out the window...).
As far as installed apps are concerned, the fact that there are several installations of it on one device is indistinguishable from being installed on several devices. So each user can access the app as though they are the user of the device.
Therefore you should be able to store files on the 'sdcard' (internal storage) and they will not be accessible to other users of the device. Assuming your user has a lock screen PIN/Password/pattern/etc. then they will not be able to access the files unless you unlock the device and 'log in' as your user.