You could make a static page of free downloads and require customers to be logged in to download the products. You can do this through Smarty:
HTML Code:
{if $login eq ''}You need to register/login to download this file{else}---download link----{/if}
This works well, but the problem is once one person has the link they can share it, or the download can be hotlinked to from another site.
You could go more advanced and custom code a downloads page that uses session data to check that the customers is registered/logged in, and that they are on your website (and not another website that is linking to your file). This is what the larger software/download sites do when you are required to register to download their trial/free software. I have done this on my soundware site, you can check it out to get an idea of what you can do within the X-Cart system.
http://www.soundbrewer.com/downloads.php
Just a few ideas.