Omeka isn’t really designed to have the files private. You can see some discussion from an earlier thread about an option involving modifying a plugin.
If you want to remove access completely you can do it with Apache (like, using an .htaccess file in files/original with a Deny from All or Require all denied).