To clarify my thoughts, and throw this out there... Here's how I'm imagining this working:
Assuming there's no problem intercepting the raw disk i/o attempts, the first time an app attempts a raw disk access, Wine can throw a popup (I know, I hate them too) with something like the following text:
An application you are running (Application Name) is attempting to access a disk in a potentially unsafe way. Would you like it to access a safe virtual disk instead?
Yes No
Pressing "Yes" results in nice, safe behavior. Pressing "No" runs winecfg opened to the "Drives" tab, with perhaps an added checkbox "Allow potentially unsafe raw access" for each (relevant) drive.
--tim