I could not find this option, so this might end up as a feature request.
Q: Is there a way to password lock and online file to ensure only those who have the URL and the password can access the files.
If this is not possible, I think it's something adobe should really think about adding as you may need to use interactive options in indesign but with content of a sensitive nature (e.g. company finances) or want to soft share a file with a limited group before allowing global access.
With publish online no password protection is possible. You need your own web space where you can save this files and protect a 3rd party plugin, like that from ajar, to export the pages so that you can move the export to your space.