Cache boundaries for public demos and private review files

How would you separate caching rules for a public demonstration video and private review files on the same site?
Suppose a project uses Video2X to prepare a clip, then publishes a public demo while keeping another version behind an authenticated review page. The processing step and the web-server configuration are separate; the question here is how to make the delivery boundary explicit.
I would separate the public poster and demo assets from the authenticated page and protected media routes. A long cache lifetime might suit an intentionally public, versioned asset, but I would not want that policy inherited accidentally by a response containing user-specific content.
For a Centmin Mod setup, would you make the primary distinction through route exclusions in Nginx, response headers from the application, or both? I would also want to check the HTML response and the actual media request separately, rather than assume that protecting the page automatically protects its video URL.
Which response headers and two-session checks would you use to confirm that an anonymous visitor cannot retrieve a private review file?

---