How to build an asset firewall

In your use case, you would check the value of the nda field, something like

if($page->template() == 'project' &&  $page->nda() == 'Yes' && !site()->user()) {
  header::forbidden();
  die('Unauthorized access');
} else {
  $file->show();
}