As the OP stated " if I were to add the PDF to a FoundryVTT Journal Entry without him having access to the actual file (can only view the PDF, not share)", they are not actually sharing the file. The file is not available for the viewer to save to their pc, and it can only be viewed while they are in the VTT instance with the owner of the file.
This seems like a long-distance way of passing a book across a table, with one exception... You don't have to worry about them running off with your book. Close the VTT and their access is gone.