On the SharePoint side, is it possible somehow to track the user that originates the request from the remote server when using the AppOnlyPolicy?
On the SharePoint side, no.
In a Provider-hosted app, it is the responsibility of the remote web to authenticate the user and pass that identity to SharePoint as part of the token. If you have trusted the app to make app-only calls, then you have to trust the app. :)