Have a look at [Perusio's config](https://github.com/perusio/drupal-with-nginx#private-file-handling), it has all the information and explanation you need :

> This config assumes that private files are stored under a directory
> named private. I suggest `sites/default/files/private` or
> `sites/<sitename>/files/private` but can be anywhere inside the site
> root as long as you keep the top level directory name private. (...)
> Example: Calling the top level private files directory protected
> instead of private.
> 
> 
> 
> 
>     location ^~ /sites/default/files/protected {          
>       internal;        
>     }
> 
> Now any attempt to access the files under this directory directly will
> return a 404.

... 
> The usual practice involves setting up a directory outside of
> files directory and giving write permissions to the web server user.
> (...)  I think it to be less advisable, in the sense that now **there's another directory that is writable by the server.**
> 
> I prefer to use a directory under files, which is the only one that is
> writable by the web server, and use the above location (protected or
> private) to block access by the client to it.


In short, marking it as internal is enough.