Not possible for the moment, but you can do it easily :
-> First, wich ACL ?
you can create a new ACL (core.download) and affect authorizations for your members.
-> Then, protect visibility
In whatever JDom calls, you can always protect view of element :
ex :
<?php echo JDom::_('html.fly.file', array(
'dataKey' => 'my_image',
'dataObject' => $row,
'target' => 'download',
...
'aclAccess' => 'core.download' // ADD ACL HERE core.download must exist
));
?>
But you only protect the view of it, wich is maybe not what you want.
-> It hide the image
-> It doesn't physically protect the against download if the user know the URL to download
So ...
If you want to see the image without link :
(in this example, if the user cannot download, the link open modal. You can replace 'modal' to '' to avoid it)
<?php echo JDom::_('html.fly.file', array(
'dataKey' => 'my_image',
'dataObject' => $row,
...
'target' => ($this->access->get('core.download')?'download':'modal')
));
?>
And now, if you want to protect pysically the download, you must add some ACL checks in your classes/files file.
Because I prefer you try to do it by yourself to learn how it works, please post here the end of the solution you found.
TODO ...
If you don't find the answer, I give you the answer.