It looks like you want to allow them to upload to this directory only, not download. In that case, I think you want to change the first Limit directive from Limit ALL. Maybe something like:
Code:
<Directory incoming>
<Limit READ>
DenyAll
</Limit>
<Limit STOR CDUP CWD XCWD XCUP STOU WRITE>
AllowAll
</Limit>
</Directory>
All inside an <Anonymous> container, is it?
Hope that helps.