You can protect posts or pages with .htaccess in Apache, but you will also need to disallow those same posts/pages in the sitemap and RSS feed.
Or, take a look at encryption: https://github.com/Li4n0/hugo_encryptor
See also How can i create a private post?