Have a look at Perusio's config, it has all the information and explanation you need  :

This config assumes that private files are stored under a directory named private. I suggest sites/default/files/private or sites/<sitename>/files/private but can be anywhere inside the site root as long as you keep the top level directory name private. (...) Example: Calling the top level private files directory protected instead of private.

location ^~ /sites/default/files/protected {          
  internal;        
}

Now any attempt to access the files under this directory directly will return a 404.

...

The usual practice involves setting up a directory outside of files directory and giving write permissions to the web server user. (...) I think it to be less advisable, in the sense that now there's another directory that is writable by the server.

I prefer to use a directory under files, which is the only one that is writable by the web server, and use the above location (protected or private) to block access by the client to it.

In short, marking it as internal is enough.

Have a look at Perusio's config, it has all the information and explanation you need. Here is a quote from it:

This config assumes that private files are stored under a directory named private. I suggest sites/default/files/private or sites/<sitename>/files/private but can be anywhere inside the site root as long as you keep the top level directory name private. (...) Example: Calling the top level private files directory protected instead of private.

location ^~ /sites/default/files/protected {          
  internal;        
}

Now any attempt to access the files under this directory directly will return a 404.

...

The usual practice involves setting up a directory outside of files directory and giving write permissions to the web server user. (...) I think it to be less advisable, in the sense that now there's another directory that is writable by the server.

I prefer to use a directory under files, which is the only one that is writable by the web server, and use the above location (protected or private) to block access by the client to it.

In short, marking it as internal is enough.

Have a look at Perusio's config, it has all the information and explanation you need.

But in short, marking it as internal is enough.

Have a look at Perusio's config, it has all the information and explanation you need :

This config assumes that private files are stored under a directory named private. I suggest sites/default/files/private or sites/<sitename>/files/private but can be anywhere inside the site root as long as you keep the top level directory name private. (...) Example: Calling the top level private files directory protected instead of private.

location ^~ /sites/default/files/protected {          
  internal;        
}

Now any attempt to access the files under this directory directly will return a 404.

...

The usual practice involves setting up a directory outside of files directory and giving write permissions to the web server user. (...) I think it to be less advisable, in the sense that now there's another directory that is writable by the server.

I prefer to use a directory under files, which is the only one that is writable by the web server, and use the above location (protected or private) to block access by the client to it.

In short, marking it as internal is enough.