You can easily resolve this by defining the permission of document at the time of creation in ACL app. To do this, please have a look at the below code snippet:
HashSet<ACL> aclSet = new HashSet<ACL>();
aclSet.Add(new ACL("<User_Name>", Permission.READ));
aclSet.Add(new ACL("<User_Name>", Permission.WRITE));
Once you set this acl permission, that user have access to write on the document based on his sessionId. So what you need to do is, append the session id of user in the above URL and get that session id in JS Code to set in storage service instance while updating user document. It will resolve your both queries because no body will know the session id of user.
In order to get the file URL using file name, please have a look at this code snippet of file upload service.
To answer your last query, as of now there is no such way to add/update emailSubject & message in your custom email template using code. I would like to suggest create run time templare in your custom code, if you need to update these fileds.
Let me know if you required any help while integrating it.
P.S Please have a look at this link to understand the concept of securing App using ACL feature.