It accesses the Documents/Images of the user you run it as (if they exist - if that user has no home, then it may not work, browsers usually store some data in home, such as the profiles and stuff).
Otherwise, the answer is yes. No regular user can (as per usual permissions on home folders) access homes of any other users, or change system files. The details depend on which group you add this user to, and the exact permissions of files you have in other places in the tree.
However, you may want to give your regular user permissions to read downloads, otherwise, the downloaded files are pretty useless. That kind of defeats the purpose of isolation.
However... it makes little to no sense to do this, if you know what you are doing. Downloaded files can't do any damage unless they are executed, and for that, they need the executable permission (which isn't normally set at download). That's pretty much windows-specific problem (where clicking on a file that looks like data, but is an application, executes it directly, as no concept of "execute permission" is in place, although newer versions are nagging all the time for anything you want to execute).
So in short... if you download a malicious script, and don't run it, no harm done. If you want to run it... you can do that as a separate user (while the browser can be run as yourself). And of course, if it's not a binary file, but a shell script, you can always open and look what it does.
And even more... linux software doesn't usually come as downloadable executables - you usually have either packages, source files, or something like that. In any case, when it comes to downloading files that are meant to be run as executables, you better know what you're doing.