You can easily script the change of source location for all content types except update packages (from memory). There is a nice community tool that will even do this for you: https://msendpointmgr.com/2015/08/26/configmgr-content-source-update-tool-1-0-0/.
For update packages, you will have to create new packages I believe.
As for your permissions, assuming the location is local to the primary site server, then removing authenticated users and users is fine as the local System account is used to access content locations. Make sure the share is set to Everyone Full.