We decided not to worry about it at this point but I did figure out that If I modified the 1 OOB ACL and set it not to run if that table was incident and then created another ACL to run on incident I would use a script to hide attachments that were not added by the user from them. This would also make it so the links in the comments would not show for them.
