Hi @sdusane
we had implement same using:
CUG : To protect page(s)/tree
LinkTransformer : To add a hide class or custom data attribute 'cug-protected-link' to all protected links while generating page. Alternatively you can do same in sling model if this is just for navigation component. we had to apply this globally so went with sling rewrite pipeline.
Servlet : Calling a servlet(POST with all the 'cug-protected-link' links ) on page load, servlet will return a json response with payload links and visibility status based on user(current session).
based on servlet response unhide 'cug-protected-link'.
considering creating dictionary with expiry in user's localStorge will help to reduce number of call to server and help with performance.