Just want to clarify my question:
I would still prefer all internal users to see all Access Point documents (including demos).
However, 1 specific user (external), should only see 1 specific document, but no other documents.
Without publisher, I could simply assign my internal users to all documents, but then only assign the external user to one specific document. But what can be done when you do have publisher?
If you have an EE server, switch to DMS security. You will obtain an Authorization tab in the section User Documents. That one lets you show/hide documents without distribution task to/from specific users.
If you don't, follow Gysbert's advice.
PS In QlikView Server context, CALs do not have any relation to authorizations.