If you have control over the firmware driving the eMMC, generate a sync pulse on an unused (or noncritical) GPIO. Then use this pulse to sync your 'scope to the host; now you can differentiate in/out by how delayed they are from the sync. For example, have the controller generate sync then immediately send a polling command on CMD. Now you can look at that command (CMD out) and immediately following it will be the response (CMD in).
If you don't have access to the firmware, try putting a resistor in series with the signal. The signal will be a slightly lower voltage on the downstream side of the resistor. Experiment with resistor values to find one that produces a detectable voltage drop without trashing the signal too badly. If you're lucky there might already be a resistor in place for noise filtering and you can work with that.