It all depends on what features you want for your file downloads.
I usually put my files in a directory above the web root, for example if my web root is "www" I'll have a directory "files" right next to it.
Then I create a Media Source with a non-relative path such as /full/path/to/files/, and leave the URL blank since that has no meaning in this case - the file is streamed from the server's file system, not served as an HTML download.
Then I create new Content Types (in the System menu) for each type of file, such as .pdf, set them as binary and with the proper mime type.
Then I create a chunk that has the same path as the Media Source. This is because while you can use a media source to select the file to link to, Static Resources don't store the media source part of the path.
So when I create a static resource for a file, in its Settings tab I select the proper Content Type and the Content Disposition as attachment, then in the Document tab I select my "files" media source, and select the file I want to link to. Then I add the chunk tags to the path that the static resource stores, so that the resource will end up with the full path to the file.
[[$source_path]]rest-of-path/to/file.pdf
Now you can use all the features of a resource, except the content field which holds the path to the file to be served. So you can search using the other fields, you can use getResources or Wayfinder to list them, you can assign them to a template so they can have TVs for tagging and filtering. The URL for the actual download will be the alias for the static resource, just like any resource's URL, so the actual path to your files is never displayed. And since the file is actually outside of the web root, nobody can get at it except through the links to the static resources.
☆ A M B ☆