What's the best way to set up security for payroll journals and registers.

We have a few people that need access to open the payroll PDFs in paperless office, but everyone else does not need access.

I thought about creating a separate folder for the payroll paperless PDF files and assigning permissions at the Windows folder level.

Any other thoughts?