How to restrict access to files to files of a node while keeping the node itself viewable?
The answer ended up being the function file_get_file_references(), referenced in /core/modules/file/src/FileAccessControlHandler.php 

https://api.drupal.org/api/drupal/core%21modules%21file%21file.module/function/file_get_file_references/8.2.x