Using API to copy a file to a folder not accessible to the user copying file

Unfortunately, Dropbox and the Dropbox API don't really offer something like this. Dropbox generally doesn't distinguish between the ability to add a new file and otherwise being able to write (e.g., update or delete) in its access controls.

Some things that do come to mind as potential solutions though:

• If the manager and all of the employees are members of the same Dropbox Business team, you could register a "Dropbox Business API" app with the "Team member file access" permission and use the "member file access" feature to administratively move files out of the employees' accounts and into a folder they don't have access to. I also recommend checking out the Namespace Guide and Content Access Guide for more information on how files/folders and access controls are structured. This blog post may also be helpful.
• You could use the /2/files/get_temporary_upload_link endpoint to get temporary upload links that could be used to upload files to a location that the employees' accounts don't actually have access to. The actual /2/files/get_temporary_upload_link calls would need to be made by an access token for an account that does have access to the destination, e.g., the manager's account, though.
• You could use file requests to collect the files from the employees. You can use the /2/file_requests/create endpoint from the manager's account to programmatically create file requests if you want different ones, or just manually make one to always use. Either way, the actual employee submissions to the file request(s) would need to be done manually though.