Hi,
It sounds like there may be a bug here. I think it should support the use case of providing streaming to the group it's access restricted to.
However, there isn't any way to only allow for streaming without the ability to also download the file (just for clarity). The basic media-viewer is simply using HTML5 (<video> and <audio> tags, etc) to provide streaming capabilities. So, if you can download the file, you should be able to stream it... and visa versa.