I think I found a solution using 2 Alfresco Sites.
1. Created a Private site called PRIVATE.
2. Created a Folder in it called "Incomming"
3. Assigned the person I wanted to have Read Access with Manager Access to the site
4. Removed Admin from from Members so only the Manager can read the content of folder.
1. Created a Public Site called PUBLIC
2. Created a Folder in it called Outgoing
3. Assigned All Users 'contributor' access to the Site
4. On the Outgoing folder I clicked 'manage rules'
5. Under 'Perform Action' I select 'Move to folder'
6. Move to PRIVATE / Incomming.
Now when a Member of the PUBLIC Site uploads a file into the Outgoing folder, the move rule immediately moves it to PRIVATE / Incomming folder that only a single person/group can read.
The only issue I have now is conributors have the ability to upload files into the ROOT of document library, not understanding they need to click on the Outgoing folder where the move rule is applied. Alfresco does not appear to allow Rules to be added to the root of the Document libary, only folders...
SUB QUESTION: Is there a way to allow users to upload to folders but NOT upload into the root of a document libary?