Then utilize .htaccess to prevent direct access to the file folder via a browser.
idk, you are literally going to have to make b2evolution into a XOOPS module if you want to fully control access.
You could technically create a separate database for it, and wrap your XOOPS frameworks around it. You will need to strip out all of the b2evolution frameworks.
Tough stuff. I would suggest you head over to b2e and see if anyone has developed a bridge. I could of sworn I had read something of the sort somewhere once before.
Any great project requires work, and coffee.