How should I let some users to download from Private folder
What field type serve the link for the download ? Maybe the module behind this type already implement this hook ?
For example, File module or Image module already implement this hook_file_download.

In case of File module, it allow you to alter the permission to access to the file. 

// Allow other modules to alter the returned grants/denies.
    drupal_alter('file_download_access', $grants, $field_item, $entity_type, $entity);


You just have to implement the hook_file_download_access_alter. By the way, there is this other hook (hook_file_download_acces) you can may be try to hook.

Finally, if no one of this hooks can help you, so may be you have to use this hook_file_download. But I don't really know what is expecting as headers, but you can look at the hook in the Image module.

There, it get headers from others modules (may be you can just use this trick) :

// Check the permissions of the original to grant access to this image.
  $headers = module_invoke_all('file_download', $original_uri);


And just after that, it make its own headers :

return array(

      // Send headers describing the image's size, and MIME-type...
      'Content-Type' =&gt; $info['mime_type'],
      'Content-Length' =&gt; $info['file_size'],
      // By not explicitly setting them here, this uses normal Drupal // Expires, Cache-Control and ETag headers to prevent proxy or // browser caching of private images.
    );


Hoping that help :)