As far as I know, you'll need to write a bit of code or use a plugin to encrypt/decrypt your json when you save/load it. One of the simplest ways is a character shift/replacement. It can be cracked, but if you have the luxury of worrying about the tiny population that would go through the effort, you probably have a wildly successful game already anyways (And then you can just change the method if you REALLY care that much. Which you probably won't.)
Loading the files from a server is indeed the most secure method. At the very least, a user would not be able to change the file.
If you think any offline game can be safe from hacking, that is simply not true. Effort and time is best spent improving your game rather than worrying about hackers, or you will never get to the point where you make a game worth hacking to begin with.