Hi, I can answer part of your question:
Very easy, just create a new theme folder, enable it in your config file,a nd override anything you want. https://docs.nextcloud.com/server/11/developer_manual/core/theming.html
I think so, although it would be a matter of downloading the source, making changes to the code, and recompiling yourself. I'm not sure if there are easier ways though.
Depending on how you define "easily", as the server administrator you could delete files from the filesystem and then just run php occ files:scan --all to tell Nextcloud that you changed some files. Otherwise I think with Nextcloud 12 using impersonate, you could actually log in as the offending user and remove the file there.
Sorry, I don't know this one. Based on your questions it sounds like you might benefit from purchasing an enterprise subscription. https://nextcloud.com/enterprise/