I am just putting here what was done to tackle this. restricted Original
image and system renditions download.only project specific renditions (
that is more or less equivalent to original image) made visiblefor
restricted images - renditions that were generated were watermarked
hence user was able to view and download only watermarked renditions.