You can forbid access to this dir with an .htaccess file with the content "deny from all" so that a request to
http://www.site.com/assets/docs/example.pdf will return a 403 error to the user.
To control right access and download, you need a php script (called like this script.php?dowload=exemple.pdf) wich check the right of the current user and send file like this.
header('Content-type: application/pdf');
header('Content-Disposition: attachment; filename="exemple.pdf"');
readfile('assets/docs/example.pdf');
