Basic Windows permission issue: web app access, but no direct web access

Basic Windows permission issue: web app access, but no direct web access

I have some files which unfortunately need to be located within the web
root but should be denied to regular users. However, they do need to be
available to one of the web apps running on the server.
Do I need to adjust permissions on the folder in the system (via File
Explorer) or from within IIS Manager?
In an ideal world, attempting to access the file via the web server will
result in a 404. At the same time, my web application should be able to
access it as a normal file.
Note that the user for the web app does not appear to be the same one
running IIS.
This is Windows Server 2008, running IIS 6.