How can I restrict assets on a per-file basis?
Why don't you just set up two separate asset sources, one default one with files being freely accessible and one source with access for logged-in users only by making use of that Internal Assets Plugin you mentioned.

Instead of managing the rights with a lightswitch you would upload or move the assets in the right source.

Another option would be to have two asset fields for your entry type, one configured for each source. And you could then always hide one of them with a lightswitch using the brand new Reasons plugin.