AFAIK, It is not possible to do what you want to do, for fundamental reasons. The user controls the client. From the server side, the server has no way to distinguish a legitimate browser that happens to be making a request for an file in the library(a case where you want to serve the file) from a malicious user who is trying to directly access the file(a case where you don't want to serve the file). These two situations are indistinguishable from the server's point of view, so the server has to behave the same way in both cases: either serve the file in both cases, or don't serve it.
You can only decide whether a user has access to download a file from your site or not, you cannot control what a determined user does with the file.
Source