Can I find out the deployment path from a JSF application?
Not right away, you need to grab a ServletContext from an ExternalContext as follows:
ServletContext servletContext = (ServletContext) externalContext.getContext();
In turn, it offers the well-known and dubious getRealPath() method.
String webContentRoot = servletContext.getRealPath("/");
If you are already using JSF 2.0, you can use ExternalContext#getRealPath() instead.
Another question (if the answer to the previous question is correct): is it legal to store some downloaded files there?
You can do it. You only need to consider that they are all lost whenever you redeploy the application, for the simple reason that these files are not contained in the original WAR.
If you want to have a slightly more persistent storage, consider storing it in a fixed path outside the web application, for example. /var/webapp/upload or so. An alternative is to store them in a database, which will increase portability, but do not forget to save some metadata (name, content type, last modified time limit, etc.) along with the contents of the file so that you have something to index / search / caching on.