First think I thought of was counting the downloads with tracking/security links and build some limitations around that like BigFurry said.
You could also "stream download" the file using javascript in the users browser (like mega.nz does). Download the file in the users memory then on completion it lets the user save the file to disk.
I will try to find some time later today to see if I can build a quick test setup using this library
https://github.com/jimmywarting/StreamSaver.js
From StreamSaver.js: "Instead of saving data in client-side storage or in memory you could now actually create a writable stream directly to the file system" Thats even better.