If your subfolder is inside your web root, then it can be tricky to prevent apache from serving them up. If you chmod the files so apache can't read them, then apache cannot see them and therefore can never serve them to a visitor.
Your best bet would be, as laserlight suggested, to move this subfolder OUT of the web root (the public_html directory) and rely on a php script to read these files from another location.
If you absolutely must leave this subfolder in the web root, then you might be able to put a DENY directive in an apache configuration file or in a .htaccess file.