you could use this plugin for that purpose (auto assigning to resource groups):
http://modx.com/extras/package/inheritresourcegroup and to make your files not accessible directly if they are above the public_html folder on your server (e.g. in assets), you can use an .htaccess file with "deny from all" as content...
