You need Oracle directory objects for that, and while you're at it you could take the external table approach as well.
So, are you talking about a user created procedure or one that comes as part of Apex?
If you are calling a procedure on the database then that procedure will only be able to access files that can be seen by the server, it cannot magically hack it's way across the network and bypass client computer o/s level security to access files on those clients hard drives.
Of course a procedure can be called with a file name, that's just a string e.g.
v_out varchar2(4000) := null;
As for the location, the oracle database typically needs a directory object name. How you pass that directory name to the procedure would also usually be as a string, though you haven't detailed this procedure for us, so we cannot help in detail.