restrict download access to new directories

[cretaceous]

my client wants to be able to add directories as needed via his admin section and upload files to them - then he wants them to be accessed only by specified users (only one user for any folder)

any documents will then be shown as a list of links for user to download or view in browser

I can do the folder creation and upload but I'm not sure how to do the "restrict access" part

what is the best approach for this?

put files outside webroot but then browse to them using passthru?
there's a 5 year old post mentioning that ...

adding ht access files dynamically does not seem a practical solution

thanks for any ideas

[cretaceous]

any ideas anyone?
I still dont know how to do this:
create a folder and apply a unique password to it