Using BDXL seems like a pretty good solution. Most of this data is archival and existing data is very unlikely to change. You can use HDD/SSD as a buffer as users upload data, and then optimize the packing to ensure you're using all available space on a disk. Possibly encrypt each user's data block on the disk. The system itself would only need to track metadata (file metadata, cartridge/disk, key). Deleting a file would be deleting the key and marking the file as inactive. Once/if a cartridge is marked as completely deleted, can just recycle it.