You mean to not expose any URL on the client side? If yes:
Its probably impossible since you will have to call some URL to get the file from the remote server - be it via your server or S3 directly.
But, you can make the URL such that it uses some single-use token. So the exact same URL would run only once, return the file data (as a blob or stream or base64 string) and will not be accessible again without generating another token.
To show the files in a modal, check out the code here. Should give you some idea: Secure Share
Here data is received from server as a string, and then shown in a modal after some processing.