Found a "dirty" trick with the htacess file:
# protect download
RewriteEngine on
RewriteRule .*download.* index.php
RewriteCond %{QUERY_STRING} .*download.*
RewriteRule .* index.php

this will redirect all urls containing the 'download' string to the index.php.
Unfortunately for all users not only for guests.

If anybody has a solution to completly disable downloads for guests i am highly interested in such a solution.