OK, so the downloads part first. Nobody can see those downloads unless they
a) was given a direct link to an item by someone who has access to see it (an image for example)
b) They have access to the admin CP, and can therefore see the files area
With regard hiding secondary groups, you can indeed do that. In order to do so you would switch off the "Allow filtering by this group?" within that group. So nobody would actually be known to have that secondary member group if they have it, as it wouldnt show, and would not show those members if someone tried to search for members of that group