You are right, a Named User CAL allows that user to see as many documents as available in the AccessPoint. However, there are several methods to make them unavailable for users. One is using the NTNAME field in section access, so the Document List in the AccesPoint is filtered by it, and if the user NTNAME is not listed in section access, he will not be able to see this document. To make sure this happens in the document, go to the Settings menu, Server tab, and check Document List Based on Section Access.
Another one is what you mention in regards to NTFS permissions, but only in the case you have chosen NTFS as your security method for authentication and NTLM as authorization in the QMC.
If you are using DMS, make sure you Authorize the correct users in the Documents, User Documents, Authorization tab within the QMC. When you generate a new task you can set it in the Distribute tab if you are using Publisher.
Hope that helps.