Sadly you normally will need to use the non direct url in order to apply roles, as if you do a direct call to the file it will normally just load the file, and Kentico has no 'say' in the matter.
So first step would be yes, you will need to use the /getmedia or /getfile type of urls (usully passing it the GUID).
Once you use that then Peter has the correct next step, use Kentico's permissions to authorize accesses.