Stop access to files in a directory on the browser with htaccess

I have a directory like so:

appname
    |
    |public/
    |   |
    |   |foobar.php
    |
    |barfoo/

If a user opens their browser to see the app they can see the folder structure and it's files if they get to https://host/appname. I have the Directory Index to look at foobar.php so when the user goes to https://host/appname/public. Foobar get's rendered fine. But I can still access the files with https://host/appname.

Should I have another .htaccess fill in the same directory as public and boofar like I do in public?

Any help is greatly appreciated as I'm trying to learn.