How to restrict file access based on file path under private directory?
Requests to files in the private file directory are routed through Drupal and access logic for these requests can be added by implementing hook_file_download.
The only argument to that hook implementation is $uri, which is the URI to the file. Using string comparison to see if you want to act upon this request should get you what you need.

Quoting the docs:


  If the user does not have permission to access the file, return -1. If the user has permission, return an array with the appropriate headers. If the file is not controlled by the current module, the return value should be NULL.