Untested, but this probably works

<location path="modulesbin">
<system.web>
<authorization>
<deny users="*" />
</authorization>
</system.web>
</location>

  <location path="your-folder">
    <system.web>
      <authorization>
        <deny users="*" />
        <allow roles="WebEditors, WebAdmins, Administrators" />
      </authorization>
    </system.web>
    <system.webServer>
      <handlers>
        <clear />
        <add name="wildcard" path="*" verb="*" type="EPiServer.Web.StaticFileHandler, EPiServer.Framework.AspNet" />
      </handlers>
    </system.webServer>
  </location>

Perfect, thanks!