$ 0 0 %h or %u in ChrootDirectory is the way to go, if you want to totally separate users. Then this answer.