The best way to solve this, is to use LVM Snapshots, to create a "virtual" drive, that is then snapshotted incrementally with regular intervals. This virtual drive is then "shared" through Samba, iSCSI or similar tool to each Windows computer.
Of course, every client can use the same virtual drive.
IF a ransomware then encrypts the files on this "virtual drive", causing all files on the shared Samba/iSCSI disk to be encrypted, you simply delete the snapshot images (which are "diff"s of a drive) until the files are accessible again.
Of course, a good idea is to have the server secured by a firewall such as so it can only be accessed through its Samba/iSCSI ports over the network.
Any console access is to made physically, at the local console.
No other solution is better, as if you mount the drive readonly you must still enforce some sort of versioning on server side, else you will overwrite a perfectly good backup with encrypted rubbish if a ransomware happens to attack.
If you use rdiff, you must still make sure the diff versioning is enforced on server-side and not client-side, else the ransomware can bypass this and overwrite all the diff's.
The best way to enforce versioning on the server side, is to use LVM Snapshots and then just share a "flat iSCSI drive" or a "Samba share" to the client computer. The advantage, is that malware, cannot know that the drive in question is versioned on the server side.
The only disadvantage with a server-side versioned drive, is that you transfer all data over the wire, even unchanged data, but that shouldn't be a problem since you transfer regularly instead of transferring all at once.