Database Engine vs. Database location
Installing SQL Server 2008 DB files on network shares really isn't fully supported properly until you get to SQL 2012.  I'm not sure how it'll work as I've never tried that in prod but you can do it.
http://www.brentozar.com/archive/2012/01/sql-server-databases-on-network-shares-nas/

To answer your security question though, no, the user authenticating against SQL Server does not need access to that file location, that file, or anything like that.  The SQL Server service account that manages that DB does need access to it though across the network.  

Also, No, the remote storage server does not need SQL Server engine or client installed.