Block file downloads for user
As it turns out this functionality was possible with only one extra module, the Content Access module.

Select the file field on the user account. You can find them at the following path:

/admin/config/people/accounts/fields

Edit the field and under permissions select, custom permissions. You'll need the Content Access module installed for this to work.

Then in permissions you can set custom permissions for the field. To allow a user to upload and not download, you give them only the ability to create or edit their field. You don't give them the permission to view it.