can I provide a download link in my www folder for the user to download? can i send this link location(that expires in 7 days) in an email? I'm just concerned about the security
No its not recommended.
Try this, make a function that takes the name of the file to download, put the logic in this function to get the file and set the header so that it can be download. By using this front end user do not know the exact path of file.
You can send that function url in email as well.