Securely host files on Azure blob for Django/React app

I'm writing an app in Django/ React that needs access to large amounts of files (think file share). I am storing the metadata for the files in a database, and users will be able to select the file from the app to download it.

I'd prefer to use App service, SQL DB, and storage separately.

What is a secure approach to provide a download link without a public CDN (controlling the authorization through the app)? Just looking for high level architecture because I haven't found any approaches online.