Puedes intentar ChrootDirectory %h:
Match group ch-users
ChrootDirectory %h
man sshd_config
The pathname may contain the following tokens that are
expanded at runtime once the connecting user has been authenticated:
%% is replaced by a literal '%', %h is replaced by the home directory of
the user being authenticated, and %u is replaced by the username of
that user.
Aunque creo que esto lo tienes que tomar en cuenta:
The ChrootDirectory must contain the necessary files and directories to
support the user's session. For an interactive session this requires at
least a shell, typically sh(1), and basic /dev nodes such as null(4),
zero(4), stdin(4), stdout(4), stderr(4), and tty(4) devices.