A media company utilizes Amazon CloudFront for content delivery and restricts access to premium customers. How can they ensure that only these customers can access media streams and on-demand content stored in an S3 bucket?