Best practice for hosting media files "other" than static website with public access?

I am completely new to S3. I have hundreds of audio files I need to host for a web app (javascript code on a client web browser needs to access the files for playback). Currently we have them in a bucket that has public read access (static website), and we understand the security risks. Ideally we have S3 configured to allow our app to get a list of files available, and do simple searches (like list all files that start with "A").

What is the easiest "alternative" to static hosting we should use that is better security-wise?

Thanks for any pointers to documentation/answers.