DJM0 if you use the "download" template, the real path on disk will never be revealed to the user, and access control is enforced.
If you use preview templates, then the real path on disk will be revealed and can be shared around.
There's no way to have access control per discussion. However if you can't see the post, you shouldn't be able to guess the file UID or path.