UUIDs are purely random and are virtually impossible to guess by design. So if you trusting your customers/users, this alone should be enough.
We could set up a custom CDN distribution with signed URLs, so that your backend server will generate temporary URLs for your users to download documents. Signed URLs will expire after some determined time, so saving and distributing them has no value. Contact us if you need this option.