Deny access to URL non-authenticated users
To control which user can access a download link, you need what is called a "private file system" in Drupal. Public files are directly served to the visitor by the web server; Drupal doesn't even come into play. Private files on the other hand are served by Drupal, so it can check permissions before sending the file.

You do not need additional modules to enable the private file system and upload files to it. The documentation should get you started. If you want to make it easy to create links in the body text to file download URL's, you could try adding the CKeditor and Linkit modules.