we do want the root folder to be accessible
Was that meant to be "don't want"?
Community isn't meant to gate-keep down to the message level. You can restrict who can see a board (or blog, or tkb) and (all) the messages in that board.
As long as they have access to messages in a board, a user (or bot) could modify the URL by editing the ID segment to find other posts in that board. Alternatively, a clever user (or bot) could leverage the API to browse the posts in that board (if they have access).
The best you could do, is create a custom board page quilt (or whatever the discussion style is), and remove the component that lists all the messages, so it becomes harder to just randomly browse the content.
But ultimately, the community isn't really designed to do what you are trying to do.
