Generally it's difficult to stop someone from downloading a document that's online, as even if it's a page without a download button, the viewer can usually "print it as a PDF", or at least take a screenshot (maybe LockDown browser can stop that, but I don't know).
Treat any file published in Canvas as something students might be able to download, as they can be accessed by guessing the file ID (unless the file is in an unpublished module).
There's probably a solution (that would make it very difficult, but probably not impossible to download) involving an iframe and an external service, but it's not likely to be accessible.