Azure AD authentication to download files

I have a customer where they have a CMS like web app developed to store word files. They are using their own authentication to log into the webapp and stores the username and password on a database. Once the users of the webapp logs in they can see word files stored on a Azure storage blob. They can edit the files online and download them. Customer wants to have a second level of authentication when editing or downloading the files. I was thinking that may be we could use Azure AD to authenticate the file editing and downloading but can't quite figure how to integrate it and give sort of a popup window where the user can input their username and password to edit or download the files. Any help on this is greatly appreciated.