You can store your software in the Remository file store. Access can be controlled by setting the groups that can access a container. Remository provides a module to show users their ID string needed to enable updates. The Remository multi-module can help you to construct the download link for the XML. More details can be found at https://docs.black-sheep-research.com/remository:joomlaupdate.