Well, it doesn't work because you've forgotten the difference between a file path and a URL. Once it's outside the web root it's no longer accessible by a URL - that's the point.
Yes, your include idea will work - call a script that reads the CSS file out. Put a Content-Type header of text/css above it so the client knows it's CSS.
No, don't bother. For your CSS to be of any use to anyone, the client has to be able to download it. Once they've done that, they've got it. So what's the point of trying to stop them from downloading it?