Justin,
You can accomplish the majority what you are describing right out of the box. The additional level of security (from the document level down to the user level) would be something you’d have to administer yourself, but in my experience is actually quite easy.
Assuming you somehow map the user’s file upload to their web user key (internalKey), a snippet or plugin to handle the download can just as easily check:
$modx->getUserLoginID();
against the record to see if access should be granted/denied.
By linking a Document Group to a defined Web User Group, (and applying said permissions to the appropriate document/web user) you will have accomplished the first step of securing the "download gateway" from unauthorized user access. The second step would be the custom PHP code to handle user-specific access to download the file.