Ideally, you’ll need the video content outside the web directory and provide a stream of audio from a controller action.
It will be difficult to fully protect the video as web browsers cache content, so in effect a user only has to browse the cache location on their computer to access the file.