I have a directory protected by htaccess. Here is the code I use now:
AuthName \"Test Area\"
Require valid-user
AuthUserFile \"/***/.htpasswd\"
AuthType basi
There is no need to create a .htaccess in the subdirectory.
Just create as many variables as you need with SetEnvIf directive, and be sure the file or path name you want to allw/deny is part of the URI regex you pass to SetEnvIf, exactly like @Sumurai8 said, but set the regex to fit your needs, for the URI should start/end/contain a set of characters............