I'm still a bit lost. The client has InfoPath installed. You are putting the InfoPath templates (XSN files) on a server. The client has limited access to this server. If you can send the secondary data to the client via e-mail, why not just send a new copy of the form down via e-mail? Same thing, no?
You could stash the XML file in the Internet Cache and use code to get to it. That's where all of the InfoPath form templates are cached. SolutionURL will point to the installation location of the form, so another solution is to have them install the form locally by creating an MSI with regform which always installs the stuff in the %AppDir%\[Your Company Name]\[Your Form Name] and then look in the registry when you want to save the XML file.
Still, I favor sending out XSN refreshes in e-mail and installing locally. There is a feature to do this in the Designer but it only works for restricted forms which isn't an issue if the 2DS (secondary data source) is in the form. If that's not possible, consider the MSI idea. Or just install your forms to the same location on all machines and use SolutionURL to get the location from your code.
Patrick Halstead [InfoPath MVP]
InfoPathDev
Patrick Halstead
Project Manager at Qdabra