Just have your user upload the files in whatever UI you have for Apache (I use Apache and mos_wsgi for Python/Flask webapps). I'm guessing you might be just using a default public/ html setup?

However your server side setup is, if it were me I wouldn't worry so much as you aren't executing the mp4 files.

But I would be careful with how the files are named; you should scrub the names and name with your own naming convention when storing on your server (before saving the file and before converting with ffmpeg - all of which I would do in Python). That way a Bash command or something else cannot be inserted into the file name etc by the end user.