The basic idea for hooking up a server, is that the server will act like any other client, except it will authenticate with an API key and have full read / write access.

This server can perform data validation for you. All you need to do is have a "unvalidated" bucket where clients put their data, and then have your server have callbacks that validate that data and copy it over into the "validated" bucket (where clients do not have write access) when everything checks out.

This would need to be in concert with ACL's to prevent clients from writing in each other's buckets.

Note that you still get the major advantages of Firebase -- simpler code, easy scaling, data accessibility, and real-time, even though you're running a server.