If you set NoRun to a 1, the user will not be able to view local files by typing a file address or URL (file://c:\....) into the Address box.
Setting NoRun to 1 will also prevent access to the local file system from an embedded HTML link.
You could also implement the NoDrives registry value to totally inhibit access to a local drive.
In addition, for compatibility with the various versions of IE 4.x, navigate to:
Add Value name NoFileUrl as a type REG_DWORD and set the data value to 1, to prevent use of the
file://c:\.... syntax in the Address box.