Hi,
after a quick look in the saned documentation[1] i think setting up saned on the clients and usinging sane with the sane-net backend shouldn't be that hard (though it requires a trusted network environment because there is no authentication/authorization besides tcp wrapper support..). You may want to tweak the users environment to set SANE_NET_HOSTS to her/his client pc.
Including tunneling support over ssh in x2go for saned is probably a tricky thing since sane uses a different tcp connection or control and data plus it resolves the port exclusivly over services.
But saned on the clients should ease the process for your users.
/rupi
1: http://www.sane-project.org/docs.html
-- http://rantanplan.org/~rupi/ || encrypt email || use free software fingerprint = 9639 0ABC AD2F 155F C96C FC78 3CFE 82C0 0AF9 AE3A