I'm assuming you can use your own forms and post to Auth.net's services directly instead of using the Hosted Forms option, although then you have CC data flowing through your systems (if not being stored by it).

Am I correct in that assumption?

Yes

Also, is there an options where we can create our own forms (with appropriately control IDs) and post back to the Auth.net servers?  That avoids the CC data flowing through our systems and gives us creative control over the input forms.

Nothing like that.