You can store your software in the Remository file store. Access can be controlled by setting the groups that can access a container. Remository provides a module to show users their ID string needed to enable updates. The Remository multi-module can help you to construct the download link for the XML. More details can be found in the Remository Manual at https://manuals.remository.com/remository/remository-as-joomla-update-server