Create randomized bucket and object names. Enable public access, but only provide specific file URLs to individuals without Google accounts who need access.

Use signed URLs to generate time-bound access to objects.

Grant no Google Cloud Identity and Access Management (Cloud IAM) roles to users, and use granular ACLs on the bucket.

Grant IAM read-only access to users, and use default ACLs on the bucket.