.htaccess is excellent for just a few users, but if you get to be more than a few dozen users it's a huge pain to edit .htaccess files manually to add new users. You could also bang out a quick php authentication using a database of some sort to store user credentials then a session and login form for validation.
You'd basically put an if check at the top of every page, to see if the session variable for validated users is set, and if it's not, redirect them to the login page. The login page processes the form against the database and sets the session variable accordingly.
But yeah, for just a few users, .htaccess is the way to go.