I also have only 3 users, myself, my MA and "staff" (everyone else). When we import through Updox into AC we use the "Comments" box at the bottom of the import window for the initials of the importee, if they are logged in as staff. Some type of authentication field would be a good suggestion to send to Updox, since they do frequent updates.
I like Jon's idea of sending faxes to Updox as emails. I have an old Macmini as my "fax machine", and it converts the incoming faxes to PDFs and emails them to my box "xxx@myupdox.com", and therefore aren't counted against my number of faxes/month. But that means you need to keep an extra fax line. In my area, AT&T charges $65/month per business line.