I am pretty sure that vhost directory configurations are processed after htaccess files. So in this case, you cannot restrict users since the htaccess file would allow them all.
You may want to look into either:
- blocking htaccess on a per-directory basis.
- Checking into the Require
and Satisfy arguments. If you add password protection in your vhost
configuration, you can use the Satisfy argument to require the user
both match the htaccess criteria and the password.
Of course test.
In general, I recommend disabling htaccess on the directory your are trying to secure if are not sure that the users will not overwrite the file. If there are directives you require in the htaccess file, you can always make it owned by a user that does not have write access so it cannot be changed.
For some clients, when we cannot remove htaccess entirely, we often set the htaccess file to be owned by an admin level user and chmod 644. This prevents the everyday webmaster from changing the file.