@DanH
I think you are almost there, just a different option chosen for the setting you are already using???
I'm assuming this is using a Chromebook device as best I can tell from your question. We needed to do this, not for a staff member, but for a lovely student (God bless him, he loves to find ways to aggravate teachers, admins, and tech staff, LOL!). He was downloading HTML games for later offline access. The student would disconnect from WiFi and become invisible to the teacher (Go Guardian in our case, but would be for any management as he was disconnected from the network), but could then play his locally downloaded games.
We set the "Download location" policy to "Force Google Drive". It sounds like this is the policy you may have set, but instead choosing the option ""Set Google Drive as default, but allow user to change". If you truly don't want to give a staff member the option of saving locally, this is the policy you'll want to change. I personally have a hard time NOT giving a staff member the choice to save locally if they really want to. If you make Google Drive the default option, but still let them choose to still save locally, that would be my personal preference. (which sounds like what you may already be doing). If a staff member choose to save locally and only locally, that's on them for not having a backup or second cloud saved version, especially if you warn them about only saving files locally.
The second part we did for the student, which you probably don't need or want, was to block ability to access locally saved file. My memory is quite fuzzy here, but I think we may have set a URL block, using the URL of the local Chrome Files app??? This didn't 100% block all access to local files in all ways, but if memory serves me correctly, it stopped the student from downloading files to local file system, and it also stopped them from browsing the local file system. I found that if the student somehow knew the path to a previously downloaded file, they could still type (or copy/paste/etc) that local file URL in their browser address bar and access said file(s). Our solution to that was to do a Chromebook wipe to clear any previously locally downloaded files. No ability to save locally and no ability to access local files.