to protect your files from unauthorized download, they need to be stored outside of the web root so that they cannot be access directly through a URL in your site.
you would then create a page that is password protected using security assist.
Add a form with a download button to the page, And use the File Manipulation Download file behavior to add the ability to download the file.
NOTE: storing files outside the web root may not be possible if you are using a shared hosting account. you may need dedicated hosting.