Just wondering if anyone can point me in the right direction please, it may not be possible - but just thought I'd ask incase.

I currently have a marketing website for a school campus, within that site we would like to create a Custom Post type Blog which is only accessible to users who enter a username/password to access it - that I can do. But my question is, if documents or images are then uploaded to that Custom Post Type, how would I make sure that they are also private and can't get listed in Google or accessed by anyone who doesn't have login credentials?