Each and every foundry has an End User license Agreement (EULA) for their fonts. They all vary to some degree. Some EULAs may forbid the client from ever sending you files to begin. Some EULAs state (paraphrasing) that sharing in order to "facilitate reproduction" is acceptable, but nothing is to be retained after reproduction. Really, only reading the license will definitively explain what you may or may not do with that foundries fonts.
In most cases, requiring a PDF/X-1a from clients really makes the whole font licensing issue a non-starter since fonts are embedded in the PDF. It certainly removes all liability for you (or your company) because no font software is ever transferred. But I also realize that some production methods kind of need live editable type for proper set up and PDFs won't always work.
Some general guidelines to try and remain ethical, if not legal, without reading everything under the sun (bullets are far more opinion based upon experience than outright fact - only the EULAs will have facts):
- Do use the fonts to facilitate production, then trash all font files when production is complete.
- Do store the fonts in a client specific folder / job jacket /
etc. so they are available should that client ever send more work and forget a font file. But the fonts should not always be "active" and available on any system. And the fonts should only be used for that client's work.
- Do limit the use of the fonts to one seat at a time. Don't just install them across all systems.
- Do archive the fonts with the rest of the job if archiving (so they will be available if that job needs reprinting)
- Do not further share the files with anyone
- Do not utilize the fonts for any other client
- Do not use the fonts to create new projects (which you state you don't do anyway)
in most cases, my experience has been that as long as you aren't further sharing files and aren't creating new projects with the files, you're probably fine.
The biggest issue I've run into in terms of production is the sharing of the files beyond the production house. An employee or someone takes the font home and the sharing begins... I've gotten to the point where I actually question print houses when they request a font and state my PDF/X file wasn't sufficient - Why do you need a font when they are embedded? - Unlike 20 years ago, I never just blindly pass on font files today merely because I've been asked to. Some font packages actually contain internal identifiers that allow a foundry to track which customer purchased the file.... and then they see it all over the internet. This opens me up to liability and in turn the production house, because if I didn't share the font with anyone except my production house... then the production house must have violated my trust with them.
All the above assumes the font is not "free". Most free fonts don't have many usage or "seat" restrictions to them.