As already mentioned by the others, this is not possible. But it is also not necessary, because the access control layer on AEM checks if you are allowed to access binaries, and there is no other way to access binaries than going through AEM and these checks.That means if you want to have APP-1 not ...