It's an old post but I'll post a reply as I ended up here after wanting to know the same thing. The short answer is that it can do both.

The LoginWidget just calls the existing SS methods for handling logins so it automatically can do what that system can do.

The built-in login system allows you to set up groups (to which you add users) and assign those groups permissions to do what you want; login to the CMS or view a particular page, or edit a particular page for example.

To create a user that can view a hidden page:
Go to the Security tab.
Create a group
Add users to that group

Go to the SiteContent tab.
Select the hidden page.
Go to the Access tab of that page
Click the Only these people (choose from list) radio button in the topmost Who can view this page? section.
Select the group you defined earlier from the drop down list.

Verify it works.

If you have files that you're making available for download then I think these need to be secured separately so check that they're not publically available.