Please refer to the answer at Create a Remote Only User in OS X.
The last part of that post will use
bindfs to mount a user privileged only folder. See below. The whole instruction set is on the blog post referenced or just look at both posts. If someone wants me to duplicate that other post here let me know.
Getting in is one thing. Now you have to mount the folder you want to use. Unfortunately you can't use a symlink inside of a chroot jail. This is where MacPorts is your best friend. I don't know why I've never seen fit to install this before. After installation just issue the following commands.
sudo port install fuse4x
sudo port install fuse4x bindfs
You might have to restart. Now with an empty folder created in
/chroot/user you can
mount --bind to a folder outside of the chroot jail. For example
sudo /opt/local/bin/bindfs -u user /Library/WebServer/Documents/mysite/yourfolder /chroot/user/scratchpad
So far this seems to work here.