If you look at the file in the Repository Files view, you can right-click on it and select "Change Access Control..." This brings up a dialog that lets you change file access to be controlled by the component, the project area or team area, an access group, or restricted to a single user.

 Yes, you can specify an access group for an individual file, which prevents everyone except for the users in the access group from being able to read/download the file