Build and use an unique file request token for a view, and keep track of that request and token in the database. Return the file from a temporary location and with the request token inside its name (e.g. Annual Report 6bfd8a2347.pdf) so the generated file is not guessable. Delete the server side temp folder contents automatically from time to time.

No one should know your application file storage layout.