You could make the uses login, set a cookie and then check the existence of the cookie before you display the feed.
Or you could give the users super secret URLs. Have some string that is md5 encoded attached to the end of the xml feed. Store it in a database and look it up before you display the XML. If theres a match, display, if not don't.