Ehhhh Strapi was not really built to do that, your really need a DAM solution for stuff like that (Digital Asset Management system).
With some providers you can enable the private bucket support (S3 compatible upload providers) which can issue signed URLs but completely locking down the assets is not really going to be easy nor advised.