Can RSA be securely used for "blind decryption"?
Let's try to simplify and abstract your protocol a bit.  Instead of your server and client, we just have two parties, let's call them Sally and Charlie.


Charlie has a key pair $K = (K_i, K_u)$ for a suitable asymmetric cryptosystem $\mathcal E$.  We assume that this cryptosystem is partially homomorphic, such that $\mathcal E_K(a) \otimes \mathcal E_K(b) = \mathcal E_K(a \odot b)$, where $\otimes$ and $\odot$ are two group operations.
Sally knows the public half $K_u$ of Charlie's key pair, so that she can compute $\mathcal E_K(a)$ given a plaintext $a$, but not the private half $K_i$ that would let her compute $a$ from $\mathcal E_K(a)$.
Sally has a message $\mathcal E_K(m)$ encrypted with Charlie's key pair, and wants to decrypt it without revealing the decrypted message $m$ to Charlie (or to anyone who might impersonate him).
Charlie wants to help Sally decrypt her message, but does not wish to reveal his private key $K_i$, or anything equivalent to it, to Sally (or to anyone who might impersonate her).


The protocol you've suggested amounts to Sally picking a random element $r$ uniformly from the group of all possible plaintexts, encrypting it using $K_u$ to get $\mathcal E_K(r)$, and sending $\mathcal E_K(m) \otimes \mathcal E_K(r) = \mathcal E_K(m \odot r)$ to Charlie.  Charlie then decrypts the message, and sends $m \odot r$ back to Sally, who applies the group inverse $r^{-1}$ of $r$ to obtain $m = (m \odot r) \odot r^{-1}$:


  
  $S:\ $choose $r$ uniformly at random, compute $E_K(r)$ and $r^{-1}$;
  $S \to C:\ \mathcal E_K(m) \otimes \mathcal E_K(r) = \mathcal E_K(m \odot r)$;
  $C:\ $decrypt $\mathcal E_K(m \odot r)$ to get $m \odot r$;
  $C \to S:\ m \odot r$;
  $S:\ $compute $m = (m \odot r) \odot r^{-1}$.
  


The first security claim (that Charlie cannot learn $m$) should be easy to prove, regardless of the specific cryptosystem used.  Since the plaintexts form a group, and $r$ is chosen uniformly at random from that group, $m \cdot r$ is also uniformly distributed, and so reveals no information about $m$ to anyone who doesn't know $r$.  Indeed, even if Sally repeats the protocol with several different random values $r_i$, and so reveals $m \odot r_i$ to Charlie, this will give him no additional information as long as all the $r_i$ are uniformly chosen and independent of $m$.

The tricky part is the second claim, and especially the part about Charlie not revealing "anything equivalent to $K_i$" to Sally.  After all, in the protocol as described, Charlie is acting as an unrestricted decryption oracle!

It seems to me that, for this protocol to make sense at all, we need at least the following assumptions:


Sally cannot be compromised in any manner that would directly reveal $m$ to the attacker; she can only be made to disclose $\mathcal E_K(m)$.
Access to Charlie is strictly limited, so that even if an attacker obtains $\mathcal E_K(m)$, they cannot simply query Charlie for $m$.


The latter assumption may indeed make sense in your scenario, where Charlie is physically connected to Sally (and only intermittently so connected, being securely stored at other times), if we also assume that Sally is resistant to active compromise (i.e. she may certain data items, but an attacker cannot modify her behavior).  That's a pretty huge assumption in practice, but if you're willing to make it, the protocol described above seems like it should work.

(That said, if you're really willing to make all those assumptions, why not simply have Charlie store $m$ and provide it directly to Sally upon request?  I'm having some trouble coming up with a reasonable attack scenario where that wouldn't be secure, yet the protocol above would be.)