You can output the file from a call to a server-side script, e.g. http://example.com/getfile.php?file=test.m4a, and after the file has been sent completely, delete it from the server, or make it inaccessible (e.g. storing the information about access in a database). This can be done with any reasonably good server-side programming language.
For live streaming, you could – again, server-side – set up a solution where a video/audio player is embedded in the webpage, and it requests the file (or the stream endpoint) using a custom token that is only generated once (when the page loads), and only valid for one client request. For example, the player in the website would request http://example.com/getfile.php?file=test.m4a&token=abcdef, and once that has been requested, the token is marked as invalid on the server. Any future request with this token would fail, and the user can only get a token once (e.g. by checking via mandatory user login).
Then again, there's this thing about DRM: It doesn't work. If people can listen to your file or play the video, nothing stops them from recording their sound card output or doing a screen capture.