Consider using Shared Access Signatures. With these signatures, you can give your user temporary access to a Blob in a private container.
Eugenio Pace's article explains exactly what you're trying to do: Windows Azure Guidance – Using Shared Key Signatures for images in a-Expense