2
i dunno about allowing only XOOPS users, but u cud simply just password protect the folder using .htaccess if ur host server allows it.. most do..
for more info on .htaccess try this link it gives a step by step guide to using htaccess..
http://www.freewebmasterhelp.com/tutorials/htaccess
part 3 tells u how to create the password file etc..
u cud then issue users with the username and password for it...