Read only filesystem snapshots (that can be restored quickly) are the best way to prevent ransomware IMPO. The snapshots can't be over-written or modified and the user can restore them whenever they like.