It's most definitely possible. It's also a bit of a hassle that I've been more than willing to contribute an hour or two of billing towards purchasing the following package from long-time, very trustworthy umbraco mvp : Richard Soeteman (i'm not a fan of using packages for many reasons so this deviation/exception is high praise/recommendation).

Check out the following as it works, and it's configurable, and there's a free trial: https://soetemansoftware.nl/media-protect

• you may have to disable logging locally since your ip might be "::1" which doesn't satisfy the ipv4 expectation of the db field.

Once you enable protection for the media folder as desired - you don't really have to extend that target membership group to anybody. As long as you AllowAccessForUmbracoUsers: true in the appropriate, well documented config section - you're good to go!

hope this helps.