You want to make sure the user has the browse permission but not the read permission for the file/repository. I believe file-level permissions will override the repository permissions. You can find more information at Access Control.
1 Like